EUVD-2026-31745
GHSA-7fc3-9hrj-6779
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Out-of-bounds read in GNU LibreDWG's dwggrep utility exposes heap memory when processing maliciously crafted DWG files containing LTYPE objects with unterminated wide-character dash text strings. Affected versions span 0.1 through 0.14 (CPE: cpe:2.3:a:gnu:libredwg). A local authenticated attacker can trigger partial information disclosure by supplying a crafted DWG file to the dwggrep command-line tool; a public proof-of-concept DWG payload exists, though EPSS of 0.01% (2nd percentile) and absence from CISA KEV indicate no widespread exploitation activity at time of analysis.
Technical ContextAI
GNU LibreDWG is an open-source C library for reading and writing AutoCAD DWG binary drawing files. The dwggrep utility (programs/dwggrep.c) searches DWG files for text patterns and, for R2007+ format files, must convert UTF-16LE wide-character strings (BITCODE_TU) to UTF-8 via the bit_convert_TU function in src/bits.c. The root cause (CWE-125, Out-of-bounds Read) is that the original MATCH_OBJECT macro call in match_LTYPE processed LTYPE object dash text entries using the unbounded bit_convert_TU without enforcing the boundary of the strings_area buffer. A DWG file can supply an LTYPE dash text pointer that is not null-terminated within the allocated strings_area, causing bit_convert_TU to walk past the buffer end. The fix introduces a bounded variant, bit_convert_TU_len, which accepts a max_wchars parameter derived from the distance between the text pointer and the end of strings_area, and returns NULL if no null terminator is found within that range. This change is applied only to the R2007+ code path; pre-R2007 files use a separate branch that processes plain char strings and is unaffected.
RemediationAI
The upstream fix is available as commit be996bf2178a40e98720f18c2414815d244413db in the LibreDWG GitHub repository (https://github.com/LibreDWG/libredwg/commit/be996bf2178a40e98720f18c2414815d244413db). No tagged release version incorporating this fix has been independently confirmed - the fix exists at commit level only, so users should build from source at or after this commit. Downstream package maintainers should backport the patch to their packaged versions. As a compensating control, restrict use of the dwggrep utility to trusted DWG files only, as the vulnerability is triggered exclusively through dwggrep processing of attacker-supplied input. Disabling or removing the dwggrep binary entirely eliminates the attack surface without affecting the core LibreDWG library functionality used by other applications. This workaround has no impact on applications that use libdwg directly rather than the dwggrep utility.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today