CVE-2026-15520: GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow
A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompressR2004section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU LibreDWGto a version that resolves this vulnerability.Fixed in 0.14.8396Patch 3d0f9fc2eddbd6579c99af3111c37c98f03475d0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15520?
The severity of CVE-2026-15520 is classified as medium with a score of 5.3.
How do I fix CVE-2026-15520?
To fix CVE-2026-15520, users should update to the latest version of GNU LibreDWG that includes the patch for this vulnerability.
What causes CVE-2026-15520?
CVE-2026-15520 is caused by a heap-based buffer overflow in the R2004 Section Decompression functionality in GNU LibreDWG.
Can CVE-2026-15520 be exploited remotely?
No, CVE-2026-15520 requires local access to the system to exploit the vulnerability.
What impact does CVE-2026-15520 have on my system?
Exploiting CVE-2026-15520 can lead to a heap-based buffer overflow, potentially allowing unauthorized access or manipulation of system memory.