EUVD-2026-31737
GHSA-f6gf-3cj7-46vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account with standard user privileges
-
DeliveryAcquire or craft malformed R2004-format DWG file
-
ExploitExecute `dwgread` with crafted file as input
-
ExecutionInvalid comp_bytes/comp_offset triggers assertion in `decompress_R2004_section`
-
Impact`dwgread` process aborts (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Local system access with at minimum standard user (non-root) privileges is required (CVSS AV:L/PR:L); remote or unauthenticated exploitation is not possible. The attacker must be able to invoke the |
| Impact | The CVSS 4.0 score of 1.9 accurately reflects the constrained threat: attack vector is local (AV:L), privileges required are low (PR:L), and impact is exclusively a limited availability loss (VA:L) against the parsing process - no confidentiality, integrity, or system-scope impact. EPSS at 0.01% (2nd percentile) is fully consistent with this, indicating negligible probability of broader exploitation in the wild. The vulnerability is not listed in CISA KEV. While a public proof-of-concept |
| Exploit ScenarioDerived | A local user with a standard (non-root) account downloads the publicly available proof-of-concept |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Reachable assertion (CWE-617) in GNU LibreDWG's decompress_R2004_section function allows a local low-privileged attacker to crash the dwgread utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
RemediationAI
Build from or update to a revision at or after upstream commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 from the LibreDWG GitHub repository (https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9); note that a formally released patched version number has not been independently confirmed at time of analysis - only the upstream commit is verified. As a compensating control, restrict execution of the dwgread binary to trusted users operating on trusted input files, since the attack requires local access with low privileges and deliberate supply of a crafted DWG file. In environments where DWG parsing is not operationally required, removing or disabling the dwgread binary eliminates exposure entirely with no functional trade-off. No network-layer mitigations are applicable given the strictly local attack vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU LibreDWG is a free C library (GNU project, CPE cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*) for reading and writing AutoCAD DWG binary files. The vulnerable function decompress_R2004_section in src/decode.c handles decompression of R2004-format DWG section blocks. CWE-617 (Reachable Assertion) identifies the root cause: an assert() reachable via attacker-controlled input - specifically, crafted comp_bytes or comp_offset values that violate internal bounds assumptions. The upstream patch (commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9) inserts explicit pre-flight bounds checks (end > dec->size, (size_t)(pos - comp_offset) >= dec->size, (size_t)comp_offset > dec->size) and returns DWG_ERR_VALUEOUTOFBOUNDS instead of allowing the assert to fire, confirming the fix converts an abort-path into a controlled error return.
Know when Libredwg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Exploit-DB