EUVD-2026-31741
GHSA-q6j5-wxg6-4vrv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 8f03865f37f5d4ffd616fef802acc980be54d300. Upgrading the affected component is advised.
AnalysisAI
Null pointer dereference in GNU LibreDWG (all versions through 0.14) allows a local, low-privileged attacker to crash any application that uses the library to parse a maliciously crafted DWG file, resulting in a denial-of-service condition with no confidentiality or integrity impact. The affected code path is within the DWG 2004 compressed-section handler in src/decode.c, where missing bounds checks on section entry address fields permit invalid memory access. A public proof-of-concept exploit file exists; however, the vulnerability is not listed in CISA KEV, EPSS sits at 0.01% (2nd percentile), and SSVC rates it non-automatable with only partial technical impact, collectively indicating negligible in-the-wild exploitation risk at time of analysis.
Technical ContextAI
GNU LibreDWG is a GNU/LGPL-licensed C library for reading and writing AutoCAD DWG binary files, identified by CPE cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*. The vulnerable code resides in src/decode.c, within the read_2004_compressed_section function (as directly confirmed by the patch commit diff), which processes compressed section data found in DWG 2004-format files. The root cause class is CWE-476 (NULL Pointer Dereference), triggered when a crafted DWG file provides section entry fields (es.fields.address) that exceed the bounds of the decompression buffer (max_decomp_size or dec.size). The upstream fix at commit 8f03865f37f5d4ffd616fef802acc980be54d300 adds two missing bounds checks: '|| es.fields.address > max_decomp_size' and '|| es.fields.address + size > dec.size', preventing the out-of-bounds access before it can dereference an invalid pointer. Notably, the CVE description names dwg_next_entity as the affected function, while both the patch and the POC filename reference read_2004_compressed_section - the description appears to misattribute the specific function.
RemediationAI
Upstream fix available (patch commit); a released patched version tag is not independently confirmed from the provided data - verify the latest tagged release on the LibreDWG GitHub repository (https://github.com/LibreDWG/libredwg) to confirm the commit is included. Build and deploy from a source revision at or after commit 8f03865f37f5d4ffd616fef802acc980be54d300. As a compensating control where patching is not immediately feasible, restrict which users can supply DWG files to LibreDWG-linked applications; since the attack vector is local (AV:L per CVSS), network-layer controls provide no mitigation. If LibreDWG is used in a file-processing service, sandbox the parsing process (e.g., using seccomp or a restricted container) so that a crash does not impact the parent service - this limits the DoS blast radius without altering library behavior. Do not rely on input filename filtering as a substitute for patching, as crafted DWG content is the trigger, not the file extension.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today