CVE-2026-9530
published 2026-05-26CVE-2026-9530: A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCNINAL
EPSS
0.14%
4.1th percentile
A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8f03865f37f5d4ffd616fef802acc980be54d300. It is advisable to implement a patch to correct this issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| gnu | libredwg | — | — |
| vim | vim | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
vendor_redhat1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libredwg: GNU LibreDWG: Denial of Service via out-of-bounds read in Dwgbmp Utility
vendor_redhat·2026-05-26·CVSS 1.9
CVE-2026-9530 [LOW] CWE-125 libredwg: GNU LibreDWG: Denial of Service via out-of-bounds read in Dwgbmp Utility
libredwg: GNU LibreDWG: Denial of Service via out-of-bounds read in Dwgbmp Utility
A flaw was found in GNU LibreDWG, specifically within the Dwgbmp Utility component. A local attacker could exploit an out-of-bounds read vulnerability in the `read_2004_compressed_section` function by manipulating a file. This could lead to a denial of service, making the application unavailable.
Package: vim (Red Hat Enterprise Linux 10) - Under investigation
Package: vim (Red Hat Enterprise Linux 6) - Under investigation
Package: vim (Red Hat Enterprise Linux 7) - Under investigation
Package: vim (Red Hat Enterprise Linux 8) - Under investigation
Package: vim (Red Hat Enterprise Linux 9) - Under investigation
Package: rhcos (Red Hat OpenShift Container Platform 4) - Under investigation
GHSA
GHSA-x5hm-p5rv-v4c7: A weakness has been identified in GNU LibreDWG up to 0
ghsa_unreviewed·2026-05-26
CVE-2026-9530 [LOW] CWE-119 GHSA-x5hm-p5rv-v4c7: A weakness has been identified in GNU LibreDWG up to 0
A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8f03865f37f5d4ffd616fef802acc980be54d300. It is advisable to implement a patch to correct this issue.
VulDB
GNU LibreDWG up to 0.14 Dwgbmp Utility src/decode.c read_2004_compressed_section out-of-bounds (Issue 1248)
vuldb·2026-05-25
CVE-2026-9530 [LOW] GNU LibreDWG up to 0.14 Dwgbmp Utility src/decode.c read_2004_compressed_section out-of-bounds (Issue 1248)
A vulnerability categorized as problematic has been discovered in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read.
This vulnerability appears as CVE-2026-9530. The attack requires local access. In addition, an exploit is available.
It is advisable to implement a patch to correct this issue.
No detection rules found.
No public exploits indexed.
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwghttps://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300https://github.com/LibreDWG/libredwg/issues/1248https://vuldb.com/submit/814275https://vuldb.com/vuln/365549https://vuldb.com/vuln/365549/ctihttps://www.gnu.org/https://github.com/LibreDWG/libredwg/issues/1248
2026-05-26
Published