EUVD-2026-31732
GHSA-hh47-vf3p-8vq5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Heap-based buffer overflow in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) exposes users of the dwgread utility to partial confidentiality, integrity, and availability compromise when processing a maliciously crafted DWG file. All released versions from 0.1 through 0.14 are affected, and a publicly available proof-of-concept exploit file exists on GitHub. No vendor patch has been issued; the project has not responded to the responsible disclosure despite early notification via issue report.
Technical ContextAI
GNU LibreDWG is an open-source C library and toolset for reading and writing AutoCAD DWG binary files (CPE: cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and is located in the read_2004_compressed_section function within src/decode.c, which is responsible for decompressing section data stored in the DWG 2004 file format. When this function processes a malformed or adversarially crafted compressed section, it writes beyond the bounds of a heap-allocated buffer, corrupting adjacent heap memory. The attack surface is the dwgread command-line utility, which invokes this parsing logic directly on user-supplied DWG files. The root cause is insufficient bounds checking during decompression of DWG 2004 section payloads.
RemediationAI
No vendor-released patch has been identified at time of analysis; the LibreDWG project maintainers have not responded to the disclosure as reported in GitHub issue https://github.com/LibreDWG/libredwg/issues/1241. As a primary compensating control, restrict invocation of dwgread and any LibreDWG-consuming application to processing only trusted, internally-generated DWG files - do not parse DWG input from untrusted, external, or user-supplied sources. If LibreDWG is deployed within an automated file processing pipeline that ingests external DWG files, sandbox or containerize the dwgread process using OS-level controls such as seccomp profiles, AppArmor policies, or a dedicated low-privilege container to limit heap corruption impact; note this adds operational overhead but constrains potential privilege escalation. Monitor the upstream repository and issue tracker at https://github.com/LibreDWG/libredwg/issues/1241 for a maintainer response or patch commit. Organizations with significant exposure to this attack surface should evaluate migration to an actively maintained DWG parsing alternative.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today