EUVD-2026-42580
GHSA-3h8r-9w82-hxmh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parsing attack requires low privileges to supply the malicious DWG; no scope change occurs and impact is bounded to the parsing process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.
AnalysisAI
Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue.
Technical ContextAI
GNU LibreDWG (CPE: cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*) is an open-source C library implementing read/write support for the AutoCAD DWG binary format, used by tools such as FreeCAD and related open-source CAD applications. The vulnerability resides in the dwg_bmp function within src/dwg.c, which is responsible for parsing BMP image data embedded inside DWG files. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: insufficient bounds checking during BMP image data parsing allows a malicious DWG file to write past the end of a heap-allocated buffer. This class of flaw exposes adjacent heap metadata or function pointers to corruption, creating conditions that can lead to process crashes or, under favorable heap layout, arbitrary code execution within the parsing application's privilege context.
RemediationAI
The primary remediation is to upgrade GNU LibreDWG to version 0.14 or later, which fully resolves the heap-based buffer overflow in the dwg_bmp function. The patched release is confirmed at https://github.com/LibreDWG/libredwg/releases/tag/0.14, and the specific fix is commit 18fd542bb4d5ccedf9de12052bf50068b2b26f06 (https://github.com/LibreDWG/libredwg/commit/18fd542bb4d5ccedf9de12052bf50068b2b26f06). For environments where an immediate upgrade is not feasible, restrict DWG file processing to sources from trusted, validated origins only - rejecting externally supplied DWG files at ingestion boundaries eliminates the attack surface. Additionally, consider running LibreDWG-based applications inside a restricted sandbox (e.g., seccomp-bpf profile, container with read-only filesystem mounts, or a dedicated low-privilege service account) to contain the blast radius if heap corruption is triggered; this does not prevent the overflow but limits lateral movement and privilege escalation opportunities.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today