CVE-2026-9500: GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow
A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9500?
The severity of CVE-2026-9500 is classified as medium with a CVSS score of 5.3.
What type of vulnerability is CVE-2026-9500?
CVE-2026-9500 is a heap-based buffer overflow vulnerability found in the GNU LibreDWG Dwgread Utility.
How do I fix CVE-2026-9500?
To mitigate CVE-2026-9500, update GNU LibreDWG to a version beyond 0.14 once a patched release is available.
What components are affected by CVE-2026-9500?
CVE-2026-9500 affects the 'read_2004_compressed_section' function in the src/decode.c file of the Dwgread Utility.
What are the attack requirements for CVE-2026-9500?
Exploitation of CVE-2026-9500 requires local access to the system running the affected version of GNU LibreDWG.