EUVD-2026-31737
GHSA-f6gf-3cj7-46vv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. A patch should be applied to remediate this issue.
AnalysisAI
Reachable assertion (CWE-617) in GNU LibreDWG's decompress_R2004_section function allows a local low-privileged attacker to crash the dwgread utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
Technical ContextAI
GNU LibreDWG is a free C library (GNU project, CPE cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*) for reading and writing AutoCAD DWG binary files. The vulnerable function decompress_R2004_section in src/decode.c handles decompression of R2004-format DWG section blocks. CWE-617 (Reachable Assertion) identifies the root cause: an assert() reachable via attacker-controlled input - specifically, crafted comp_bytes or comp_offset values that violate internal bounds assumptions. The upstream patch (commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9) inserts explicit pre-flight bounds checks (end > dec->size, (size_t)(pos - comp_offset) >= dec->size, (size_t)comp_offset > dec->size) and returns DWG_ERR_VALUEOUTOFBOUNDS instead of allowing the assert to fire, confirming the fix converts an abort-path into a controlled error return.
RemediationAI
Build from or update to a revision at or after upstream commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 from the LibreDWG GitHub repository (https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9); note that a formally released patched version number has not been independently confirmed at time of analysis - only the upstream commit is verified. As a compensating control, restrict execution of the dwgread binary to trusted users operating on trusted input files, since the attack requires local access with low privileges and deliberate supply of a crafted DWG file. In environments where DWG parsing is not operationally required, removing or disabling the dwgread binary eliminates exposure entirely with no functional trade-off. No network-layer mitigations are applicable given the strictly local attack vector.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today