CVE-2026-90622: GNU libredwg Use-After-Free Vulnerability

CVE-2026-90622 Overview

CVE-2026-90622 is a null pointer dereference vulnerability in GNU LibreDWG version 0.13.4. The flaw resides in the DWG_TABLE function within src/dwg.spec, part of the Layer Encoding component. Processing a crafted DWG file triggers a null pointer dereference, causing the library or any application linking it to crash. Exploitation requires local access and low privileges. A public exploit exists, and the issue is tracked under CWE-404: Improper Resource Shutdown or Release. The maintainers addressed the defect in release 0.14 via commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a.

Critical Impact
A malformed DWG file processed by an unpatched LibreDWG build crashes the parsing process, resulting in denial of service for CAD viewers, converters, and automation pipelines that depend on the library.

Affected Products

GNU LibreDWG 0.13.4
Downstream CAD tooling that links or embeds LibreDWG 0.13.4
Any Linux distribution package built from LibreDWG 0.13.4

Discovery Timeline

2026-09-14 - CVE-2026-90622 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90622

Vulnerability Analysis

LibreDWG is the GNU library for reading and writing AutoCAD DWG files. The defect surfaces in DWG_TABLE inside src/dwg.spec while encoding the LAYER object. The encoder writes the layer's material handle without first validating that the handle pointer is non-null. When a crafted or malformed layer table entry omits the material handle, the raw zeroing assignments dereference a null pointer and abort the process.

The attack surface is local file parsing. Any workflow that ingests untrusted DWG input, including headless conversion scripts, thumbnail generators, and interactive viewers, inherits the crash risk. Because LibreDWG is embedded in numerous CAD utilities across Linux distributions, the blast radius extends beyond direct users of the library.

Root Cause

Commit 27118c40 ("encode: also disable LAYER.material") introduced two raw zeroing assignments that bypass the file's existing if (_obj->style) guard convention. The FIELD_HANDLE macro itself is null-safe and emits null_handle when the handle is absent. The raw assignments added by the earlier change skipped this check, so an unset material handle triggers a null pointer dereference during encoding.

Attack Vector

A local attacker supplies a specially crafted DWG file to a user or service that invokes LibreDWG 0.13.4 for encoding. Processing the malformed layer table entry drives DWG_TABLE down the vulnerable code path and terminates the process. Exploit code has been released publicly, lowering the barrier to reproduction. The impact is limited to availability; the vulnerability does not enable code execution or information disclosure.

A reproducer is available in the maintainer's LibreDWG Issue #1269 discussion. Refer to the upstream advisory for technical details rather than synthetic proof-of-concept code.

Detection Methods for CVE-2026-90622

Indicators of Compromise

Unexpected SIGSEGV termination of processes linking libredwg.so when parsing untrusted DWG input.
Core dumps referencing DWG_TABLE in src/dwg.spec during LAYER encoding.
Presence of LibreDWG 0.13.4 binaries on systems that accept externally sourced DWG files.

Detection Strategies

Inventory all hosts and container images that ship LibreDWG 0.13.4 using package managers or software bill of materials (SBOM) tooling.
Enable core dump collection for CAD conversion services and alert on crashes whose backtraces reference dwg.spec or DWG_TABLE.
Sandbox DWG parsing jobs and monitor exit codes; a non-zero exit combined with a DWG input filename is a strong signal.

Monitoring Recommendations

Track process crash telemetry on Linux workloads that host CAD pipelines and correlate with recent DWG file ingestion.
Watch upstream advisories from the LibreDWG project for follow-up patches.
Log file provenance for DWG artifacts entering conversion pipelines to support post-incident triage.

How to Mitigate CVE-2026-90622

Immediate Actions Required

Upgrade LibreDWG to version 0.14 or later, which contains commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a.
Rebuild and redeploy any downstream binaries statically linked against LibreDWG 0.13.4.
Restrict DWG parsing to trusted inputs until the patched build is rolled out.

Patch Information

The fix restores the file's existing if (_obj->style) guard convention for the material handle, preventing the null dereference in DWG_TABLE. Review the LibreDWG Commit Update for the exact source change and the LibreDWG Release 0.14 notes for packaging guidance.

Workarounds

Run LibreDWG-based tooling under a resource-isolated sandbox so that a crash does not disrupt the parent workflow.
Pre-validate DWG inputs with an alternate parser or file-type check before invoking LibreDWG 0.13.4.
Disable automated LAYER encoding paths in downstream tooling until the upgrade to 0.14 is complete.

bash

# Configuration example: verify installed LibreDWG version and upgrade
dwgread --version

# Debian/Ubuntu: rebuild from upstream 0.14 source
git clone https://github.com/LibreDWG/libredwg.git
cd libredwg
git checkout 0.14
./autogen.sh && ./configure && make && sudo make install