EUVD-2026-43263
GHSA-67vr-6jq3-273m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privilege required per CVSS 4.0 source data; uniform low CIA impact consistent with heap overflow without scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. You should upgrade the affected component.
AnalysisAI
Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in decompress_R2004_section within src/decode.c and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Technical ContextAI
GNU LibreDWG is an open-source C library maintained under the GNU project for reading and writing AutoCAD DWG binary files. The R2004 DWG format (AutoCAD 2004 and later) uses a proprietary section-based compression scheme. The vulnerable function decompress_R2004_section in src/decode.c fails to adequately validate input bounds before writing to a heap-allocated destination buffer during decompression of R2004-format section data. CWE-122 (Heap-Based Buffer Overflow) identifies the root cause: attacker-controlled section metadata or compressed data can cause writes beyond the intended allocation boundary, corrupting adjacent heap structures. The affected CPE cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:* indicates all versions through 0.13.4-154-g0b573035 are vulnerable, and the fix is confirmed at commit 3d0f9fc2eddbd6579c99af3111c37c98f03475d0 in release 0.14.8396.
RemediationAI
Upgrade GNU LibreDWG to version 0.14.8396 or later, which incorporates the fix in commit 3d0f9fc2eddbd6579c99af3111c37c98f03475d0; the release is available at https://github.com/LibreDWG/libredwg/releases/tag/0.14.8396. If immediate upgrade is not feasible, restrict processing of externally sourced or untrusted DWG files - specifically block ingestion of files containing R2004-format sections at the application layer. For server-side document conversion pipelines, sandbox the LibreDWG process using a container, Linux namespaces, or a seccomp-bpf profile to constrain the impact of heap exploitation; note that this does not prevent the overflow but limits post-exploitation reach. Compiling LibreDWG with -D_FORTIFY_SOURCE=2 and heap hardening flags can aid in detecting exploitation at runtime but may introduce minor build compatibility issues depending on the toolchain.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today