PT-2026-43130 · Gnu · Libredwg

Pwn3Rd · Published 2026-04-22 · Updated 2026-05-25 · CVE-2026-9502

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNU LibreDWG versions prior to 0.15

Description A heap-based buffer overflow exists in the Dwgread Utility component within the decompress R2004 section() function of the src/decode.c file. This issue occurs during the processing of DWG format files and can be exploited locally to cause a denial of service, which is a condition where the software becomes unavailable or crashes.

Recommendations Deploy the patch with identifier e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 for versions prior to 0.15.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

CWE-120

Related Identifiers

BDU:2026-07299

CVE-2026-9502

Affected Products

Libredwg

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9502.json · Exploit
• 🔥 https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_overflow_decompress_R2004_section.dwg · Exploit
• https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9502 · Security Note
• https://bdu.fstec.ru/vul/2026-07299 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9502 · Vendor Advisory
• https://github.com/LibreDWG/libredwg/issues/1243 · Note
• https://gnu.org · Note
• https://vuldb.com/submit/814259 · Note
• https://vuldb.com/vuln/365484 · Note
• https://vuldb.com/vuln/365484/cti · Note