CVE-2026-15182: GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwgbmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU LibreDWGto a version that resolves this vulnerability.Fixed in 0.14Patch 18fd542bb4d5ccedf9de12052bf50068b2b26f06
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15182?
The severity of CVE-2026-15182 is rated medium with a score of 5.3.
How do I fix CVE-2026-15182?
To fix CVE-2026-15182, update GNU LibreDWG to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-15182?
CVE-2026-15182 is a heap-based buffer overflow vulnerability.
Is CVE-2026-15182 exploitable remotely?
CVE-2026-15182 must be exploited locally, meaning an attacker must have local access to the affected system.
What component is affected by CVE-2026-15182?
The affected component in CVE-2026-15182 is the BMP Image Handler within the dwg_bmp function of src/dwg.c.