CVE-2026-9501 - GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion

Back Back to CVE browser

MEDIUM

GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion

Published May 25, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.16%

Description

A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. A patch should be applied to remediate this issue.

Affected products

Vendor GNU Product LibreDWG Default
n/a
- Version
  0.1
  Status
  affected
  Constraints
  -
- Version
  0.10
  Status
  affected
  Constraints
  -
- Version
  0.11
  Status
  affected
  Constraints
  -
- Version
  0.12
  Status
  affected
  Constraints
  -
- Version
  0.13
  Status
  affected
  Constraints
  -
- Version
  0.14
  Status
  affected
  Constraints
  -
- Version
  0.2
  Status
  affected
  Constraints
  -
- Version
  0.3
  Status
  affected
  Constraints
  -
- Version
  0.4
  Status
  affected
  Constraints
  -
- Version
  0.5
  Status
  affected
  Constraints
  -
- Version
  0.6
  Status
  affected
  Constraints
  -
- Version
  0.7
  Status
  affected
  Constraints
  -
- Version
  0.8
  Status
  affected
  Constraints
  -
- Version
  0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GNU

LibreDWG

n/a

Version	Status	Constraints
0.1	affected	-
0.10	affected	-
0.11	affected	-
0.12	affected	-
0.13	affected	-
0.14	affected	-
0.2	affected	-
0.3	affected	-
0.4	affected	-
0.5	affected	-
0.6	affected	-
0.7	affected	-
0.8	affected	-
0.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-617

References (8)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31737
Advisory
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_assert_fail_decompress_R2004_section.dwg
exploit
https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9
patch
https://github.com/LibreDWG/libredwg/issues/1242
issue-tracking
https://vuldb.com/submit/814250
third-party-advisory
https://vuldb.com/vuln/365483
vdb-entrytechnical-description
https://vuldb.com/vuln/365483/cti
signaturepermissions-required
https://www.gnu.org/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31737		Advisory
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_assert_fail_decompress_R2004_section.dwg		exploit
https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9		patch
https://github.com/LibreDWG/libredwg/issues/1242		issue-tracking
https://vuldb.com/submit/814250		third-party-advisory
https://vuldb.com/vuln/365483		vdb-entrytechnical-description
https://vuldb.com/vuln/365483/cti		signaturepermissions-required
https://www.gnu.org/		product