Low severity · published Jul 9, 2026
CVE-2026-15184
GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreDWG · GNU
0.13.0; 0.13.1; 0.13.2; 0.13.3; 0.13.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15184
github.com
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_dwggrep_segv_null_read_dwg_next_entity_dwg.c_1231.dwg
github.com
https://github.com/LibreDWG/libredwg/commit/dde45dac3c4d902e4d8fed150a8017b9732019c9
github.com
https://github.com/LibreDWG/libredwg/issues/1253
github.com
https://github.com/LibreDWG/libredwg/releases/tag/0.14
vuldb.com
https://vuldb.com/cve/CVE-2026-15184
vuldb.com
https://vuldb.com/submit/851192
More from LibreDWG
9.8
CVE-2022-35164
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain
9.8
CVE-2021-28237
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13
9.8
CVE-2019-20914
An issue was discovered in GNU LibreDWG through 0.9.3
9.1
CVE-2019-9774
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645
9.1
CVE-2019-9775
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645