Low severity · published May 26, 2026
CVE-2026-9530
GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8f03865f37f5d4ffd616fef802acc980be54d300. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreDWG · GNU
0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +8 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9530
github.com
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg
github.com
https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300
github.com
https://github.com/LibreDWG/libredwg/issues/1248
vuldb.com
https://vuldb.com/submit/814275
vuldb.com
https://vuldb.com/vuln/365549
vuldb.com
https://vuldb.com/vuln/365549/cti
More from LibreDWG
9.8
CVE-2022-35164
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain
9.8
CVE-2021-28237
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13
9.8
CVE-2019-20914
An issue was discovered in GNU LibreDWG through 0.9.3
9.1
CVE-2019-9774
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645
9.1
CVE-2019-9775
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645