CVE-2026-9605
HIGHGNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
Title source: cnaDescription
A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.
References (7)
Core 7
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-365678 | GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
https://vuldb.com/vuln/365678
Signature, Permissions Required signature
permissions-required
VDB-365678 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/365678/cti
Third Party Advisory third-party-advisory
Submit #818197 | LibreDWG libredwg (including the dwgbmp utility) 0.13.4.8160 Buffer Overflow
https://vuldb.com/submit/818197
Issue Tracking issue-tracking
https://github.com/LibreDWG/libredwg/issues/1248
Exploit exploit
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg
Broken Link, Product broken-link
product
https://www.gnu.org/
Scores
CVSS v3
7.3
EPSS
0.0034
EPSS Percentile
25.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-119
CWE-122
Status
published
Products (1)
GNU/libredwg
0.13.4.8160
Published
May 27, 2026
Tracked Since
May 27, 2026