What’s Vulnerable › Vulnerabilities

CVE-2026-9504: GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-25 · updated 2026-07-23
• Weakness: CWE-119

Description

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

Affected products

• GNU LibreDWG: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+8)

References

• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_overflow_bit_convert_TU.dwg
• https://github.com/LibreDWG/libredwg/commit/be996bf2178a40e98720f18c2414815d244413db
• https://github.com/LibreDWG/libredwg/issues/1246
• https://vuldb.com/submit/814261
• https://vuldb.com/vuln/365486
• https://vuldb.com/vuln/365486/cti
• https://www.gnu.org/
• https://github.com/LibreDWG/libredwg/issues/1246

Get alerted when CVE-2026-9504 or the next vulnerability affects your stack