CVE-2026-9529: GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-07-23
Weakness: CWE-404

Description

A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component Dwggrep Utility. Performing a manipulation results in null pointer dereference. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.

Affected products

GNU LibreDWG: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+8)

References

https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg
https://github.com/LibreDWG/libredwg/issues/1247
https://vuldb.com/submit/814273
https://vuldb.com/vuln/365548
https://vuldb.com/vuln/365548/cti
https://www.gnu.org/

Get alerted when CVE-2026-9529 or the next vulnerability affects your stack