PatchSiren cyber security CVE debrief
CVE-2026-9501 GNU CVE debrief
A local-only assertion failure vulnerability exists in GNU LibreDWG versions up to 0.14, specifically within the decompress_R2004_section function in src/decode.c. The vulnerability allows a local attacker to trigger a reachable assertion through crafted input to the Dwgread Utility. The CVSS 4.0 score of 1.9 (LOW) reflects the local attack vector and limited availability impact. The vulnerability was published on 2026-05-25 and modified on 2026-05-26. A patch commit (e501cb9926c1e9a07a0d1cc997f3e69e9be801c9) is available and should be applied to remediate this issue. The exploit has been publicly disclosed, though the local execution requirement significantly limits attack surface.
- Vendor
- GNU
- Product
- LibreDWG
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations using GNU LibreDWG for DWG file processing, particularly in automated or multi-user environments where local file processing occurs. System administrators maintaining LibreDWG installations should prioritize patching. Developers integrating LibreDWG libraries should update dependencies. Security teams should assess exposure based on local user access to DWG processing tools.
Technical summary
The decompress_R2004_section function in src/decode.c of GNU LibreDWG 0.14 and earlier contains a reachable assertion vulnerability. Local attackers can trigger this assertion failure through manipulated input to the Dwgread Utility. The vulnerability is classified as CWE-617 (Reachable Assertion) with a LOW severity CVSS 4.0 score of 1.9 due to the local attack vector and limited availability impact. A fix has been committed to the project repository.
Defensive priority
LOW
Recommended defensive actions
- Apply patch commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 to remediate the reachable assertion vulnerability in decompress_R2004_section
- Upgrade to LibreDWG version containing the patch commit
- Restrict local access to Dwgread Utility where patching is not immediately feasible
- Monitor for updated stable releases from the LibreDWG project
- Review local file processing workflows for untrusted DWG file handling
Evidence notes
Vulnerability confirmed through official CVE record and NVD entry. Patch commit verified in LibreDWG repository. Exploit demonstration file publicly available. Vendor attribution to GNU LibreDWG project based on source references.
Official resources
Public disclosure occurred on 2026-05-25 with exploit availability confirmed. The vulnerability is tracked as CWE-617 (Reachable Assertion).