Gnu Libredwg vulnerabilities

CVE-2019-9778 [HIGH] CWE-125 CVE-2019-9778: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec.

CVE-2022-45332 [HIGH] CWE-787 CVE-2022-45332: LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR1 LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c.

CVE-2026-15182 [MEDIUM] CWE-119 CVE-2026-15182: A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dw A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is s

CVE-2025-61154 [MEDIUM] CWE-122 CVE-2025-61154: Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a cra Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.

CVE-2026-15520 [MEDIUM] CWE-119 CVE-2026-15520: A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decom A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized.

CVE-2026-9500 [MEDIUM] CWE-119 CVE-2026-9500: A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004 A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made public and could be used. The projec

CVE-2021-45950 [MEDIUM] CWE-787 CVE-2021-45950: LibreDWG 0.12.4.4313 through 0.12.4.4367 has an out-of-bounds write in dwg_free_BLOCK_private (calle LibreDWG 0.12.4.4313 through 0.12.4.4367 has an out-of-bounds write in dwg_free_BLOCK_private (called from dwg_free_BLOCK and dwg_free_object).

CVE-2026-9502 [MEDIUM] CWE-119 CVE-2026-9502: A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R200 A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is e501cb

CVE-2020-15807 [MEDIUM] CWE-476 CVE-2020-15807: GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files. GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.

CVE-2019-20013 [MEDIUM] CWE-770 CVE-2019-20013: An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessi An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec.

CVE-2019-20009 [MEDIUM] CWE-770 CVE-2019-20009: An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessi An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.spec.

CVE-2019-20015 [MEDIUM] CWE-770 CVE-2019-20015: An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memo An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.

CVE-2019-20012 [MEDIUM] CWE-770 CVE-2019-20012: An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memo An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec.

CVE-2018-14443 [MEDIUM] CWE-119 CVE-2018-14443: get_first_owned_object in dwg.c in GNU LibreDWG 0.5.1036 allows remote attackers to cause a denial o get_first_owned_object in dwg.c in GNU LibreDWG 0.5.1036 allows remote attackers to cause a denial of service (SEGV).

CVE-2020-21835 [MEDIUM] CWE-476 CVE-2020-21835: A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../sr A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2337.

CVE-2020-6610 [MEDIUM] CWE-770 CVE-2020-6610: GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_ GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.

CVE-2020-21839 [MEDIUM] CWE-401 CVE-2020-21839: An issue was discovered in GNU LibreDWG 0.10. Crafted input will lead to an memory leak in dwg_decod An issue was discovered in GNU LibreDWG 0.10. Crafted input will lead to an memory leak in dwg_decode_eed ../../src/decode.c:3638.

CVE-2020-21834 [MEDIUM] CWE-476 CVE-2020-21834: A null pointer deference issue exists in GNU LibreDWG 0.10 via get_bmp ../../programs/dwgbmp.c:164. A null pointer deference issue exists in GNU LibreDWG 0.10 via get_bmp ../../programs/dwgbmp.c:164.

CVE-2020-6611 [MEDIUM] CWE-476 CVE-2020-6611: GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c. GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.

CVE-2020-6615 [MEDIUM] CWE-476 CVE-2020-6615: GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (d GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl).