GNU LibreDWG CVE-2026-9504

The attacker must have local access to the system with at least low-privilege OS credentials (CVSS PR:L, AV:L). The dwggrep utility must be installed and invoked - either directly by the attacker or by an automated pipeline - against a maliciously crafted DWG file. The crafted file must be in R2007-or-later DWG format, contain an LTYPE object with dashes entries, and have a dash text pointer referencing a wide-character string that is not null-terminated within the bounds of the strings_area buffer. Pre-R2007 DWG files do not trigger the vulnerable code path. Exploitation is not automatable (SSVC: no) - there is no network-facing attack surface; dwggrep is a local command-line tool with no daemon or service mode. The impact is limited to reading partial heap contents (VC:L); no privilege escalation, remote code execution, or persistent access is achievable through this vector alone.

Real-world risk is very low across all available signals. The CVSS 4.0 score of 1.9 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N reflects local-only access with low privilege requirement and impact limited to partial confidentiality loss - no integrity or availability impact is indicated. EPSS at 0.01% (2nd percentile) aligns with the low CVSS, suggesting near-zero probability of exploitation in the 30-day window. The vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation. SSVC designates exploitation as poc-only, technical impact as partial, and automatable as no - meaning automated mass exploitation is not feasible. The limiting factors stack: attacker must have local OS access, must be able to supply a crafted DWG file to the dwggrep process, and the impact is read-only heap memory leakage rather than code execution. The public POC is a crafted DWG file (not a weaponized exploit framework), consistent with researcher-grade disclosure rather than opportunistic exploitation. The tags 'Buffer Overflow' from VulDB appear to be a labeling imprecision - the CVSS vector, CWE-125, and commit diff all confirm an out-of-bounds read, not a write/overflow that could achieve code execution.

An attacker with local OS access places a specially crafted DWG file containing an LTYPE object whose R2007+ dash text field points to a wide-character string that is not null-terminated within the strings_area buffer, then induces a user or automated process to run dwggrep against the file. The original unbounded bit_convert_TU call reads beyond the strings_area allocation, potentially leaking a small number of adjacent heap bytes into output or accessible memory. A public proof-of-concept DWG payload demonstrating this behavior is available at https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_overflow_bit_convert_TU.dwg.