GNU LibreDWG CVE-2026-9502

Exploitation requires local system access with at least low-privilege user credentials (CVSS PR:L, AV:L) on a host where GNU LibreDWG 0.1 through 0.14 is installed and the dwgread utility is accessible. The vulnerable code path is triggered only when processing a DWG file containing an R2004-format section with invalid decompression parameters. No network-facing exposure exists - remote unauthenticated exploitation is not possible per the CVSS vector. SSVC confirms automatable:no, ruling out mass network-scanning exploitation. Exploitation is further limited by the partial-only impact scope (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N), meaning no scope change beyond the vulnerable component itself. The realistic risk surface is environments where untrusted DWG files can be fed to the dwgread utility by a local, potentially malicious user - for example, multi-user Linux workstations or automated build and conversion pipelines ingesting external CAD files.

Despite the presence of a public POC, multiple signals converge on low real-world risk. The CVSS 4.0 score of 1.9 reflects a local-only attack vector (AV:L), low complexity (AC:L), no additional attack requirements (AT:N), low privileges required (PR:L), and only partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L with no scope change). EPSS at 0.01% places this in the 2nd percentile of exploitation likelihood. SSVC aligns: exploitation status is 'none', automatable is 'no', and technical impact is 'partial'. The vulnerability is not listed in CISA KEV. The E:P modifier in the CVSS vector confirms a POC exists, but POC availability and active exploitation are distinct signals - there is no evidence this is being exploited in the wild. The primary limiting factor is the local attack vector: an adversary must already have local system access with at least low-privilege credentials, making this nearly irrelevant in cloud or network-threat models. Organizations where untrusted users can invoke dwgread against untrusted DWG files (e.g., shared Linux workstations, build pipelines processing external files) carry the most realistic exposure.

A local user with standard (low-privilege) access on a system running LibreDWG 0.14 or earlier crafts or downloads a malicious DWG file containing an R2004 section with invalid comp_bytes and comp_offset values - a sample is publicly available at https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_overflow_decompress_R2004_section.dwg. The user passes this file to the dwgread utility, triggering decompress_R2004_section to write beyond the bounds of the dec output buffer on the heap. Depending on heap layout, this could overwrite adjacent metadata or data structures, potentially leading to a crash or, in a targeted scenario, partial memory disclosure or corruption.