CVE-2026-9530
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In GNU LibreDWG up to 0.14, a vulnerability was found in the function read_2004_compressed_section of src/decode.c in the Dwgbmp Utility component. Manipulation can lead to out-of-bounds read. Local access is required.
Risk Assessment
The risk involves potential out-of-bounds memory read, which could lead to disclosure of sensitive information or system instability.
Recommendation
It is recommended to apply the patch identified as 8f03865f37f5d4ffd616fef802acc980be54d300 to fix this vulnerability.
Original NVD description (English source)
A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8f03865f37f5d4ffd616fef802acc980be54d300. It is advisable to implement a patch to correct this issue.