EUVD-2026-42581
GHSA-fgx7-4whx-rx6p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege access required to supply crafted DWG input; scope unchanged, no confidentiality or integrity impact, availability limited to vulnerable process crash.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.
AnalysisAI
Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the dwg_next_entity function in src/dwg.c, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.
Technical ContextAI
GNU LibreDWG is an open-source C library (CPE: cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*) for reading and writing AutoCAD DWG binary files. The affected function dwg_next_entity in src/dwg.c iterates over DWG file entity objects. CWE-476 (Null Pointer Dereference) identifies the root cause: the next_obj argument is not validated for null before being dereferenced, so a crafted DWG file that produces a null next_obj value triggers a segmentation fault. The vulnerability is distinct from CVE-2026-9503, which affects the same library, indicating a pattern of input validation issues in the DWG file handler. Tools that embed LibreDWG for DWG parsing - such as converters, CAD viewers, and batch processors like dwggrep - inherit this flaw.
RemediationAI
Upgrade GNU LibreDWG to version 0.14, which resolves the null pointer dereference. The fix is implemented in upstream commit dde45dac3c4d902e4d8fed150a8017b9732019c9 and the patched release is available at https://github.com/LibreDWG/libredwg/releases/tag/0.14. If an immediate upgrade is not feasible, restrict which users and processes can supply DWG files to LibreDWG-based applications - for example, by enforcing file source whitelisting or running the DWG parser in a sandboxed, resource-limited subprocess so a crash does not affect the parent service. Applications that embed LibreDWG should perform input validation or file format pre-screening at the application boundary before passing data to the library. These compensating controls reduce exposure but do not eliminate the underlying defect and should be treated as temporary measures only.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today