CVE-2026-9502: Heap-based Buffer Overflow in GNU LibreDWG
A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. To fix this issue, it is recommended to deploy a patch.
AI Analysis
Technical Summary
This vulnerability affects GNU LibreDWG up to version 0.14 in the decompress_R2004_section function of src/decode.c, causing a heap-based buffer overflow. The flaw can be triggered locally by an attacker with limited privileges, potentially leading to memory corruption. The exploit code is publicly available. The vulnerability is tracked as CVE-2026-9502 with a CVSS 4.8 rating, indicating medium severity. Although a patch commit identifier is known, no official vendor advisory or remediation status is confirmed.
Potential Impact
The heap-based buffer overflow may allow a local attacker to corrupt memory, which could lead to denial of service or potentially arbitrary code execution depending on the context. However, exploitation requires local access and no user interaction is needed. The medium CVSS score reflects these conditions and the limited attack vector. There are no confirmed reports of exploitation in the wild.
Mitigation Recommendations
A patch identified by commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch or upgrade to a version beyond 0.14 if available. Patch status is not yet confirmed by the vendor advisory; therefore, check the official GNU LibreDWG sources for the latest remediation guidance.
CVE-2026-9502: Heap-based Buffer Overflow in GNU LibreDWG
Description
A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. To fix this issue, it is recommended to deploy a patch.
CVSS v4.0
Score 4.8medium
Affected software
pkg:github/libredwg/libredwgRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects GNU LibreDWG up to version 0.14 in the decompress_R2004_section function of src/decode.c, causing a heap-based buffer overflow. The flaw can be triggered locally by an attacker with limited privileges, potentially leading to memory corruption. The exploit code is publicly available. The vulnerability is tracked as CVE-2026-9502 with a CVSS 4.8 rating, indicating medium severity. Although a patch commit identifier is known, no official vendor advisory or remediation status is confirmed.
Potential Impact
The heap-based buffer overflow may allow a local attacker to corrupt memory, which could lead to denial of service or potentially arbitrary code execution depending on the context. However, exploitation requires local access and no user interaction is needed. The medium CVSS score reflects these conditions and the limited attack vector. There are no confirmed reports of exploitation in the wild.
Mitigation Recommendations
A patch identified by commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch or upgrade to a version beyond 0.14 if available. Patch status is not yet confirmed by the vendor advisory; therefore, check the official GNU LibreDWG sources for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-25T10:03:54.408Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a154dfd5a0512ce3e9d9bf8
Added to database: 05/26/2026, 07:38:37 UTC
Last enriched: 05/26/2026, 07:38:55 UTC
Last updated: 07/27/2026, 08:52:03 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.