GNU LibreDWG CVE-2026-9500

Local system access is required (AV:L); remote network-based exploitation is not possible for this vulnerability. The attacker must hold low-level local privileges (PR:L) but does not require administrative or root access, and no user interaction is required (UI:N). The specific triggering condition is that the dwgread utility or a LibreDWG-consuming application must be invoked to parse a specially crafted DWG file containing a malformed 2004-format compressed section. Exploitation is limited by the mandatory local access constraint, which eliminates all network-based attack scenarios. The SSVC non-automatable signal further confirms that mass or scripted exploitation is not feasible. Impact is scoped entirely to the vulnerable process - no subsequent system or cross-process impact is expected per CVSS scope metrics (SC:N, SI:N, SA:N).

Overall risk is low in absolute terms but contextually relevant for environments that process untrusted DWG files. The CVSS 4.0 score of 1.9 reflects a local-only attack vector (AV:L), low required privileges (PR:L), and only partial impact limited to the vulnerable system with no scope change to subsequent systems (SC:N, SI:N, SA:N). The EPSS score of 0.01% at the 2nd percentile confirms very low observed exploitation probability in the wild. The SSVC framework rates exploitation at 'poc' level, the attack as non-automatable, and technical impact as partial - all consistent with a low-priority finding in most environments. A proof-of-concept exploit file is publicly available on GitHub (E:P supplemental signal), which lowers the attacker skill bar, but the mandatory local access requirement significantly constrains the realistic threat surface. This vulnerability is not listed in the CISA KEV catalog. No conflict between CVSS signals and the description was identified: the local attack vector is explicitly corroborated by the description text. The primary elevated-risk scenario is automated CAD file processing pipelines where semi-trusted or external users can submit DWG files for local parsing.

A local attacker with low-level system privileges crafts or obtains a malicious DWG file - a working proof-of-concept is publicly available at https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg - and submits it to a system where dwgread or a LibreDWG-based application processes it. During parsing of the DWG 2004 compressed section, the read_2004_compressed_section function writes out-of-bounds on the heap, corrupting adjacent memory with limited but measurable impact on confidentiality, integrity, and availability of the affected process.