GNU LibreDWG EUVD-2026-102294

Exploitation requires an attacker-supplied DWG file in R2004 or R2010+ format containing an AcDs section with a large 'schdat' schema property type value that exceeds the static table bounds used by acds_private(). The victim (or an automated service) must actually open or process that file with dwgread, dwg2dxf, or any application linked against LibreDWG through version 0.14.8612 - the AV:L/UI:P vector means there is no remote or autonomous trigger; the malicious file must be delivered and parsed locally. No authentication is required (PR:N), and default configurations are affected since AcDs decoding is part of normal DWG parsing, but the practical limiting factors are the need for file delivery, user/pipeline interaction to open it, and the file reaching the AcDs decode path (R2004/R2010+ drawings).

This is a medium-severity, defense-in-depth-class file-parsing flaw rather than a top-priority emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) yields 6.9 and is internally consistent with the description: exploitation is LOCAL and requires the victim to process a malicious file (UI:P), so there is no network-facing, zero-click exposure. The dominant impact is availability (VA:H = a crash/DoS of dwgread, dwg2dxf, or any consumer of LibreDWG), with only limited confidentiality impact (VC:L) from the out-of-bounds read potentially disclosing adjacent static-table memory; there is no integrity impact (VI:N), consistent with CWE-125. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. These signals do not conflict, but note a detailed third-party technical write-up (hackmd) and the exact vulnerable source location are referenced, which lowers the effort an attacker needs to reproduce the crash even though no packaged exploit is confirmed. Realistic priority is highest for environments that auto-ingest untrusted DWG files (conversion services, CI pipelines, thumbnailers); it is low priority for systems that only open trusted/self-generated drawings.

An attacker crafts a malicious R2004 or R2010+ DWG file whose AcDs section contains an oversized 'schdat' schema property type value and delivers it to a victim (email attachment, upload to a DWG conversion/preview service, or shared project file). When the victim or an automated pipeline processes the file with dwgread, dwg2dxf, or another LibreDWG-based application, the acds_private() decoder uses the unchecked index to read beyond a static table, crashing the process and potentially leaking adjacent memory. No packaged public exploit is confirmed, but the referenced technical write-up documents the trigger in detail.