CVE-2026-9504

LOW

GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds

Title source: cna
STIX 2.1

Description

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365486 | GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds
https://vuldb.com/vuln/365486
Signature, Permissions Required signature permissions-required
VDB-365486 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/365486/cti
Third Party Advisory third-party-advisory
Submit #814261 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) Out-of-bounds Read (CWE-125)
https://vuldb.com/submit/814261
Issue Tracking issue-tracking
https://github.com/LibreDWG/libredwg/issues/1246
Product product
https://www.gnu.org/

Scores

CVSS v3 3.3
EPSS 0.0014
EPSS Percentile 4.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-125
Status published
Products (14)
GNU/LibreDWG 0.1
GNU/LibreDWG 0.10
GNU/LibreDWG 0.11
GNU/LibreDWG 0.12
GNU/LibreDWG 0.13
GNU/LibreDWG 0.14
GNU/LibreDWG 0.2
GNU/LibreDWG 0.3
GNU/LibreDWG 0.4
GNU/LibreDWG 0.5
... and 4 more
Published May 25, 2026
Tracked Since May 26, 2026