CVE-2026-9500: GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow
A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read2004compressedsection of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GNU LibreDWG Dwgread Utilityfrom your environment.Uninstall the Dwgread Utility from systems where it is not required.
- Compensating control
Restrict local access and execution of the Dwgread Utility to trusted accounts only (for example, remove execute permission for untrusted users, restrict access via OS-level ACLs, or isolate the utility on dedicated hosts). The vulnerability is exploitable only with local access, so limiting local access reduces risk.
- Operational
Track upstream (GNU LibreDWG) for a vendor fix or advisory and plan to apply the patch promptly when released. Monitor for signs of exploitation on systems that have the utility installed because a public exploit exists.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9500?
The severity of CVE-2026-9500 is classified as medium with a CVSS score of 5.3.
What type of vulnerability is CVE-2026-9500?
CVE-2026-9500 is a heap-based buffer overflow vulnerability found in the GNU LibreDWG Dwgread Utility.
How do I fix CVE-2026-9500?
To mitigate CVE-2026-9500, update GNU LibreDWG to a version beyond 0.14 once a patched release is available.
What components are affected by CVE-2026-9500?
CVE-2026-9500 affects the 'read_2004_compressed_section' function in the src/decode.c file of the Dwgread Utility.
What are the attack requirements for CVE-2026-9500?
Exploitation of CVE-2026-9500 requires local access to the system running the affected version of GNU LibreDWG.