PatchSiren cyber security CVE debrief
CVE-2026-9504 GNU CVE debrief
A local out-of-bounds read vulnerability exists in GNU LibreDWG through version 0.14, specifically within the `bit_convert_TU` function in `programs/dwggrep.c` of the Dwggrep utility. The vulnerability allows a local attacker to trigger an out-of-bounds read condition. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and limited impact scope. A patch is available via commit `be996bf2178a40e98720f18c2414815d244413db`. The issue was published on 2026-05-25 and last modified on 2026-05-26. No known exploitation in ransomware campaigns has been reported, and this vulnerability is not listed in CISA KEV.
- Vendor
- GNU
- Product
- LibreDWG
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
System administrators managing multi-user environments with LibreDWG installations, security teams tracking local privilege escalation vectors, and developers integrating LibreDWG components into CAD processing pipelines
Technical summary
The vulnerability resides in the `bit_convert_TU` function within `programs/dwggrep.c` of GNU LibreDWG versions up to 0.14. The function fails to properly validate bounds when processing data, resulting in an out-of-bounds read condition. This is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read). The attack requires local access to the system and exploitation involves manipulation of the Dwggrep utility. The CVSS 4.0 vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), with low confidentiality impact (VC:L) and no integrity or availability impact. A fix has been committed to the official repository.
Defensive priority
low
Recommended defensive actions
- Apply the official patch from commit be996bf2178a40e98720f18c2414815d244413db to address the out-of-bounds read in bit_convert_TU
- Upgrade to LibreDWG version 0.15 or later when available
- Restrict local access to the Dwggrep utility on multi-user systems
- Monitor for suspicious local activity involving crafted DWG files
- Review local file permissions to limit untrusted user access to the utility
Evidence notes
Vulnerability details sourced from NVD and Vuldb. Patch commit verified through official LibreDWG repository. CWE-119 and CWE-125 identified as applicable weaknesses.
Official resources
public