GNU LibreDWG CVE-2026-9530

Local filesystem access with low-level privileges (PR:L per CVSS 4.0 vector) is required - remote network-based exploitation is not possible without an intermediary file upload or intake mechanism. The attacker must supply a crafted DWG 2004-format file to be processed by the dwgbmp utility or another application that calls read_2004_compressed_section(). The vulnerability triggers during parsing of a DWG 2004 section whose header fields (es.fields.address or es.fields.address + size) exceed the decompression buffer size. No special non-default configuration is required - any use of LibreDWG to open DWG 2004 files is affected. Limiting factors include: mandatory local access or control over the file input path to a LibreDWG process, inability to exploit remotely without a file intake vector, and crash-only impact with no confirmed code execution path.

CVSS 4.0 score of 1.9 accurately reflects the constrained risk: AV:L requires local access, PR:L demands at minimum low-privilege credentials, and the only confirmed impact is VA:L (partial availability - crash). No confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N) impact is indicated. EPSS at 0.01% (2nd percentile) confirms negligible in-the-wild exploitation probability. SSVC designation of non-automatable with partial technical impact aligns with the local-access requirement and crash-only outcome. A POC DWG file is publicly available, which is a distinct signal from active exploitation - this does not elevate to KEV-level concern. The primary real-world risk is a denial-of-service crash in file-processing pipelines that ingest untrusted DWG files. For organizations that do not process externally sourced DWG files with LibreDWG, exposure is negligible. The POC filename references 'heap_oob_write' while NVD and CWE classify this as out-of-bounds read (CWE-125); this minor discrepancy is unresolved from available data and does not materially change the risk profile.

A local attacker with standard user privileges places a crafted DWG 2004 file on a system where a LibreDWG-based application (such as dwgbmp) automatically or manually processes DWG files - for example, a shared rendering or conversion service. The malicious file contains section header fields with an address or address+size value exceeding the decompression buffer bounds, triggering an out-of-bounds read in read_2004_compressed_section and crashing the application. A proof-of-concept DWG file is publicly available at https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg, lowering the bar for reproduction.