PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9504 GNU CVE debrief

A local out-of-bounds read vulnerability exists in GNU LibreDWG through version 0.14, specifically within the `bit_convert_TU` function in `programs/dwggrep.c` of the Dwggrep utility. The vulnerability allows a local attacker to trigger an out-of-bounds read condition. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and limited impact scope. A patch is available via commit `be996bf2178a40e98720f18c2414815d244413db`. The issue was published on 2026-05-25 and last modified on 2026-05-26. No known exploitation in ransomware campaigns has been reported, and this vulnerability is not listed in CISA KEV.

Vendor
GNU
Product
LibreDWG
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

System administrators managing multi-user environments with LibreDWG installations, security teams tracking local privilege escalation vectors, and developers integrating LibreDWG components into CAD processing pipelines

Technical summary

The vulnerability resides in the `bit_convert_TU` function within `programs/dwggrep.c` of GNU LibreDWG versions up to 0.14. The function fails to properly validate bounds when processing data, resulting in an out-of-bounds read condition. This is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read). The attack requires local access to the system and exploitation involves manipulation of the Dwggrep utility. The CVSS 4.0 vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), with low confidentiality impact (VC:L) and no integrity or availability impact. A fix has been committed to the official repository.

Defensive priority

low

Recommended defensive actions

  • Apply the official patch from commit be996bf2178a40e98720f18c2414815d244413db to address the out-of-bounds read in bit_convert_TU
  • Upgrade to LibreDWG version 0.15 or later when available
  • Restrict local access to the Dwggrep utility on multi-user systems
  • Monitor for suspicious local activity involving crafted DWG files
  • Review local file permissions to limit untrusted user access to the utility

Evidence notes

Vulnerability details sourced from NVD and Vuldb. Patch commit verified through official LibreDWG repository. CWE-119 and CWE-125 identified as applicable weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9504 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9504

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9504 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9504

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.