TI-2026-08349 Aliases CVE-2026-9503 GHSA-q6j5-wxg6-4vrv

GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference

MEDIUM 55CWE-404Published 2026-05-25 · Updated 2026-05-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 8f03865f37f5d4ffd616fef802acc980be54d300. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00113 1st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GNU	LibreDWG	0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14	—	No fix listed	CNA

LibreDWG VendorGNU Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:libredwg::::::::	—	—	GNU

cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:* Versions — — ·GNU

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-9503
2026-10-03 Alias added: GHSA-q6j5-wxg6-4vrv

References

Exploit 1

https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg

Patch 1

https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300

Other 2

TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8

See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences