EUVD-2026-31788
GHSA-5ppw-fxgq-3w56
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component Dwggrep Utility. Performing a manipulation results in null pointer dereference. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Null pointer dereference in GNU LibreDWG's dwggrep utility crashes the application when processing a maliciously crafted DWG file. The vulnerability resides in the match_BLOCK_HEADER function within dwggrep.c and affects all tracked releases from version 0.1 through 0.14. A local authenticated attacker can exploit this to cause denial of service against the dwggrep utility; no publicly available exploit code exists for confidentiality or integrity compromise, consistent with the CVSS impact scores of VC:N/VI:N/VA:L. Publicly available exploit code exists (no KEV listing), though EPSS at 0.01% reflects negligible widespread exploitation probability.
Technical ContextAI
GNU LibreDWG is an open-source C library for reading and writing DWG files, the native binary format used by AutoCAD. The dwggrep utility (dwggrep.c) provides grep-like searching within DWG files. The vulnerable function match_BLOCK_HEADER processes BLOCK_HEADER entities during this search. CWE-476 (NULL Pointer Dereference) indicates the function fails to validate a pointer before dereferencing it - likely when parsing a malformed or unexpected structure within a crafted DWG file - causing a null dereference and process crash. The CPE string cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:* with EUVD-confirmed affected versions spanning 0.1 through 0.14 suggests the root cause is a long-standing missing null check rather than a recent regression. Notably, the referenced POC file is named 'heap_oob_write_read' which conflicts with the CWE-476 null pointer classification - this discrepancy should be verified against the upstream GitHub issue #1247.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fixed version is referenced in any advisory, CPE data, or the upstream GitHub issue #1247. Organizations using GNU LibreDWG should monitor the upstream repository at https://github.com/LibreDWG/libredwg for a fix. As a compensating control, restrict use of the dwggrep utility to trusted, validated DWG files only - do not run dwggrep against untrusted or externally sourced DWG input, as the attack requires local execution of the tool against a crafted file. In automated pipelines that invoke dwggrep, consider sandboxing execution (e.g., via a restricted container or seccomp profile) to limit the blast radius of a crash to the isolated process. Since impact is limited to availability of the dwggrep utility (not the library itself), deployments that do not use dwggrep for DWG searching are not exposed to this specific attack path.
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. Rated critica
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Rated critical severity (CVSS 9.8),
GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. Rated high severity (CVSS 8.8), this vulnerability is remotely e
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. Rated critical severity (CVSS 9.1), this vulnerability is remo
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135. Rated high se
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985. Rat
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. Rated high s
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today