This vulnerability affects GNU LibreDWG up to version 0.14 in the decompress_R2004_section function of src/decode.c, causing a heap-based buffer overflow. The flaw can be triggered locally by an attacker with limited privileges, potentially leading to memory corruption. The exploit code is publicly available. The vulnerability is tracked as CVE-2026-9502 with a CVSS 4.8 rating, indicating medium severity. Although a patch commit identifier is known, no official vendor advisory or remediation status is confirmed.

The heap-based buffer overflow may allow a local attacker to corrupt memory, which could lead to denial of service or potentially arbitrary code execution depending on the context. However, exploitation requires local access and no user interaction is needed. The medium CVSS score reflects these conditions and the limited attack vector. There are no confirmed reports of exploitation in the wild.

A patch identified by commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch or upgrade to a version beyond 0.14 if available. Patch status is not yet confirmed by the vendor advisory; therefore, check the official GNU LibreDWG sources for the latest remediation guidance.