GNU LibreDWG EUVD-2026-31741

Local system access with low privileges is required (AV:L/PR:L per CVSS 4.0 vector). The attacker must be able to supply a crafted DWG file to an application that invokes LibreDWG's DWG 2004 compressed-section parser - specifically, the file must use the 2004 compressed section format, as indicated by both the patch diff (read_2004_compressed_section) and the POC filename. No user interaction is required once the file is passed to the parser. Exploitation is limited to crashing the LibreDWG-linked process (local DoS); there is no path to remote exploitation, privilege escalation, or data disclosure. The SSVC 'Automatable: no' rating confirms this cannot be trivially scripted for mass targeting. Exploitation is further limited to contexts where an attacker can directly invoke or influence file parsing - LibreDWG deployed as a purely backend library processing only internally sourced files is not realistically at risk.

The CVSS 4.0 base score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P) reflects a genuinely low-severity issue: local attack vector only, low privileges required, and impact limited to partial availability (process crash). EPSS at 0.01% (2nd percentile) corroborates negligible real-world exploitation probability. The vulnerability is not present in CISA KEV, confirming no confirmed active exploitation. SSVC assessment - Exploitation: poc, Automatable: no, Technical Impact: partial - aligns with these signals and further confirms this cannot be mass-exploited at scale. Despite a publicly available POC, all signals converge on a low-priority finding. One internal conflict: the exploit file is named for 'heap_oob_write_read' while CWE-476 (NULL Pointer Dereference) is assigned - the actual memory corruption primitive may be an out-of-bounds access rather than a pure null dereference; defenders should note that the precise crash type is inferred, not independently lab-confirmed from the provided data. This vulnerability is only a meaningful priority if LibreDWG is used in a service that automatically processes untrusted DWG files submitted by external or semi-trusted users.

A local attacker with a low-privileged shell account on a system running a LibreDWG-linked application (such as a CAD file converter or document management tool) submits the publicly available POC DWG file (https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg) for processing. The malformed 2004 compressed section causes read_2004_compressed_section in src/decode.c to access memory at an address beyond the decompression buffer bounds, triggering a null pointer dereference and crashing the parsing process. The crash terminates the application or worker thread, achieving a localized denial-of-service; no code execution or data exfiltration is enabled by this primitive.