CVE-2026-9504: Out-of-Bounds Read in GNU LibreDWG
A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.
AI Analysis
Technical Summary
This vulnerability affects the bit_convert_TU function in the Dwggrep utility of GNU LibreDWG versions 0.1 through 0.14. The flaw causes an out-of-bounds read, which can lead to potential information disclosure or program instability. The attack vector is local, requiring the attacker to have local access and low privileges. The vulnerability has a CVSS 4.8 (medium) score, reflecting limited impact and exploit complexity. A patch has been identified by its commit hash, but no official vendor advisory or remediation level is provided in the data.
Potential Impact
The out-of-bounds read could allow a local attacker to read memory outside the intended buffer, potentially leading to information disclosure or application crashes. The vulnerability does not allow remote exploitation or privilege escalation. The presence of a public exploit increases the risk of local attacks. However, the overall impact is limited by the requirement for local access and low privileges.
Mitigation Recommendations
A patch identified by commit be996bf2178a40e98720f18c2414815d244413db is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch or upgrade to a version of GNU LibreDWG that includes this fix. Patch status is not yet confirmed by an official advisory—check the vendor's resources for current remediation guidance.
CVE-2026-9504: Out-of-Bounds Read in GNU LibreDWG
Description
A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.
CVSS v4.0
Score 4.8medium
Affected software
pkg:github/libredwg/libredwgRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the bit_convert_TU function in the Dwggrep utility of GNU LibreDWG versions 0.1 through 0.14. The flaw causes an out-of-bounds read, which can lead to potential information disclosure or program instability. The attack vector is local, requiring the attacker to have local access and low privileges. The vulnerability has a CVSS 4.8 (medium) score, reflecting limited impact and exploit complexity. A patch has been identified by its commit hash, but no official vendor advisory or remediation level is provided in the data.
Potential Impact
The out-of-bounds read could allow a local attacker to read memory outside the intended buffer, potentially leading to information disclosure or application crashes. The vulnerability does not allow remote exploitation or privilege escalation. The presence of a public exploit increases the risk of local attacks. However, the overall impact is limited by the requirement for local access and low privileges.
Mitigation Recommendations
A patch identified by commit be996bf2178a40e98720f18c2414815d244413db is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch or upgrade to a version of GNU LibreDWG that includes this fix. Patch status is not yet confirmed by an official advisory—check the vendor's resources for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-25T10:04:28.109Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a14c1afa5ae1af1aaedc5c6
Added to database: 05/25/2026, 21:39:59 UTC
Last enriched: 05/25/2026, 21:54:53 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.