Medium severity · published Jul 9, 2026
CVE-2026-15182
GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreDWG · GNU
0.13.0; 0.13.1; 0.13.2; 0.13.3; 0.13.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15182
github.com
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_heap_overflow_decode_R13_R2000.dwg
github.com
https://github.com/LibreDWG/libredwg/commit/18fd542bb4d5ccedf9de12052bf50068b2b26f06
github.com
https://github.com/LibreDWG/libredwg/issues/1249
github.com
https://github.com/LibreDWG/libredwg/issues/1252
github.com
https://github.com/LibreDWG/libredwg/releases/tag/0.14
vuldb.com
https://vuldb.com/cve/CVE-2026-15182
More from LibreDWG
9.8
CVE-2022-35164
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain
9.8
CVE-2021-28237
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13
9.8
CVE-2019-20914
An issue was discovered in GNU LibreDWG through 0.9.3
9.1
CVE-2019-9774
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645
9.1
CVE-2019-9775
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645