CVE-2026-15520: GNU LibreDWG Buffer Overflow Vulnerability

CVE-2026-15520 Overview

CVE-2026-15520 is a heap-based buffer overflow [CWE-119] in GNU LibreDWG version 0.13.4-154-g0b573035. The flaw resides in the decompress_R2004_section function within src/decode.c, part of the R2004 Section Decompression component. An attacker with local access can craft a malicious DWG file that triggers an out-of-bounds heap write during decompression. The exploit code has been publicly disclosed on GitHub, increasing the risk of opportunistic abuse against tools and workflows that parse untrusted DWG files. The maintainers addressed the issue in LibreDWG version 0.14.8396 via commit 3d0f9fc2eddbd6579c99af3111c37c98f03475d0.

Critical Impact
Parsing a malicious DWG file with a vulnerable LibreDWG build causes a heap-buffer-overflow WRITE, enabling memory corruption and potential local code execution in the context of the process.

Affected Products

GNU LibreDWG 0.13.4-154-g0b573035
Applications and CAD toolchains that link against or embed vulnerable LibreDWG builds
Downstream Linux distributions packaging LibreDWG prior to 0.14.8396

Discovery Timeline

2026-07-13 - CVE-2026-15520 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database
Patch commit 3d0f9fc2eddbd6579c99af3111c37c98f03475d0 released in LibreDWG 0.14.8396

Technical Details for CVE-2026-15520

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow write in decompress_R2004_section, the routine LibreDWG uses to decompress R2004-format DWG section streams. During decompression, the code updates dec.size with a per-section value smaller than the true allocation size. That mutation causes bit_chain_alloc to shrink the underlying buffer through a realloc. The decompression loop continues advancing dec.byte and dec.size against the original expectations, driving writes past the end of the shrunken heap allocation. The result is heap metadata corruption and adjacent chunk overwrites within the LibreDWG process.

Root Cause

The root cause is incorrect bookkeeping of the decompression sink buffer size. The dec.size field should remain pinned to info->max_decomp_size, which reflects the actual allocation. Assigning a smaller es.fields.page_size-derived value triggers bit_chain_alloc to reduce the allocation, while later writes still target offsets valid only against the original larger buffer.

Attack Vector

Exploitation requires local access and the ability to supply a crafted DWG file to a process using a vulnerable LibreDWG build. A user opening or converting an attacker-supplied DWG in a tool that links LibreDWG is sufficient to reach the vulnerable path. A public proof-of-concept DWG is available in the HackC0der CVE-Repos repository.

           dec.byte = es.fields.address;
           /* == j * info->max_decomp_size;*/ // offset
           LOG_INSANE ("dec offset: %" PRIuSIZE "\n", dec.byte);
-          dec.size = dec.byte + info->max_decomp_size; /*es.fields.page_size;*/
+          /* dec.size stays pinned to max_decomp_size (the true allocation).
+             Overwriting it here with a smaller per-section value causes
+             bit_chain_alloc to realloc the buffer to a smaller size, then
+             dec.byte and dec.size drift past the shrunk allocation resulting
+             in a heap-buffer-overflow WRITE (GHSA-qg2f-8389-w95j). The
+             pre-loop guard already ensures address+max_decomp_size <=
+             max_decomp_size, so the decompress bounds check is still valid. */
           LOG_INSANE ("dec size: %" PRIuSIZE "\n", dec.size);
           dat->size = dat->byte + es.fields.data_size;
           if (dat->size > orig_size)

Source: LibreDWG commit 3d0f9fc2

Detection Methods for CVE-2026-15520

Indicators of Compromise

Crashes or ASan reports in processes linking LibreDWG referencing decompress_R2004_section or bit_chain_alloc.
Presence of the public PoC filename libredwg_0b57303_heap_overflow_decompress_R2004_section.dwg on endpoints.
Unexpected creation or download of DWG files followed by an immediate parser crash on the same host.

Detection Strategies

Inventory installed LibreDWG binaries and libraries and flag versions predating 0.14.8396.
Monitor DWG-parsing processes (dwgread, dwg2SVG, dwg2dxf) for abnormal termination signals such as SIGSEGV or SIGABRT.
Deploy fuzzing or sanitizer-enabled builds in CI pipelines that consume DWG inputs to surface heap overflows early.

Monitoring Recommendations

Alert on DWG files delivered via email, file shares, or web downloads to hosts running CAD software.
Track child process spawns and memory faults associated with LibreDWG-linked applications.
Log and review command-line invocations of LibreDWG utilities that reference untrusted file paths.

How to Mitigate CVE-2026-15520

Immediate Actions Required

Upgrade LibreDWG to version 0.14.8396 or later on all systems and rebuild dependent applications.
Restrict processing of DWG files from untrusted sources until patched builds are deployed.
Audit third-party applications that bundle LibreDWG and apply vendor updates as they become available.

Patch Information

The fix is available in the LibreDWG 0.14.8396 release and applied via commit 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. Additional context is available in the GitHub Security Advisory GHSA-qg2f-8389-w95j and the upstream issue #1251.

Workarounds

Avoid running LibreDWG utilities against DWG files from unverified sources.
Execute DWG parsing in sandboxed environments or containers with least-privilege user accounts.
Where feasible, disable or remove R2004 section parsing paths in downstream tooling until the patched version is installed.

bash

# Verify installed LibreDWG version and rebuild from the patched source
dwgread --version

git clone https://github.com/LibreDWG/libredwg.git
cd libredwg
git checkout 0.14.8396
./autogen.sh
./configure --disable-bindings
make -j"$(nproc)"
sudo make install