CVE-2026-9501: GNU LibreDWG Path Traversal Vulnerability

CVE-2026-9501 Overview

CVE-2026-9501 is a reachable assertion vulnerability [CWE-617] affecting GNU LibreDWG versions up to 0.14. The flaw resides in the decompress_R2004_section function in src/decode.c, invoked through the Dwgread Utility component. A crafted DWG file can trigger an assertion failure, terminating the parsing process and causing a denial of service. Exploitation requires local execution with low privileges, and a public proof-of-concept has been disclosed. The LibreDWG project has released patch e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 to address the issue.

Critical Impact
Local attackers supplying malicious DWG files can crash the Dwgread Utility, disrupting CAD file processing workflows that rely on GNU LibreDWG.

Affected Products

GNU LibreDWG versions up to and including 0.14
Dwgread Utility component within LibreDWG
Applications and pipelines embedding the vulnerable decompress_R2004_section decoder

Discovery Timeline

2026-05-25 - CVE-2026-9501 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9501

Vulnerability Analysis

The vulnerability is a reachable assertion [CWE-617] in the R2004 section decompression routine of GNU LibreDWG. When the Dwgread Utility parses a DWG file with malformed compression metadata, the decompress_R2004_section function reaches an internal assertion that aborts the program. The result is an unexpected process termination rather than memory corruption or code execution. Because the attack vector is local and the impact is limited to availability of the parsing process, the overall risk is constrained. However, automated CAD processing pipelines and batch conversion services that ingest untrusted DWG files can still experience repeated crashes.

Root Cause

The root cause is insufficient validation of compression offsets and byte counts before performing LZ77-style decompression. The decoder accepts comp_offset and comp_bytes values from attacker-controlled file structures without verifying that the resulting positions fall within dec->size. When the computed source or destination position falls outside the decompression buffer, the function reaches an assertion that aborts execution instead of returning an error gracefully.

Attack Vector

An attacker constructs a malformed DWG file that supplies invalid compression offset or length values targeting the R2004 section decoder. The attacker delivers the file to a local user or service that invokes dwgread or a library consumer of LibreDWG. When the utility parses the file, control reaches decompress_R2004_section, the bounds assertion fails, and the process terminates. No authentication bypass or memory corruption occurs.

           opcode1 = 0x11;
           LOG_INSANE (">O %x!\n", opcode1);
         }
+      if (end > dec->size || (long)pos < comp_offset
+          || (size_t)(pos - comp_offset) >= dec->size
+          || (size_t)comp_offset > dec->size)
+        {
+          LOG_ERROR ("Invalid decompression bytes %d, offset %d", comp_bytes,
+                     comp_offset);
+          return DWG_ERR_VALUEOUTOFBOUNDS;
+        }
       // GH #1204: memmove is wrong here: when comp_offset < comp_bytes the
       // source and destination overlap and newly-written bytes must be read
       // back (LZ77 run-length extension). memmove copies from original bytes.

Source: GitHub Commit e501cb9. The patch adds explicit bounds checks and returns DWG_ERR_VALUEOUTOFBOUNDS instead of letting execution reach the failing assertion.

Detection Methods for CVE-2026-9501

Indicators of Compromise

Unexpected termination of dwgread or other LibreDWG-based binaries with assertion failure messages in stderr or system logs
DWG files originating from untrusted sources placed in directories monitored by automated parsers or conversion services
Repeated process crashes correlating to the ingestion of a specific DWG file matching the public proof-of-concept sample referenced in the HackC0der CVE-Repos repository

Detection Strategies

Monitor process exit codes and core dumps generated by dwgread and other LibreDWG consumers for signals consistent with assertion failures
Inventory installed LibreDWG packages and flag systems running versions at or below 0.14 that do not include commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9
Inspect DWG files prior to processing using static validators that confirm compression headers fall within declared section bounds

Monitoring Recommendations

Forward logs from CAD file processing pipelines to a centralized log platform and alert on repeated abnormal termination of LibreDWG processes
Track file submissions to multi-user CAD ingestion services and correlate crashes with the submitting user or workflow
Audit local user accounts with the ability to invoke dwgread on shared systems where DWG files are processed automatically

How to Mitigate CVE-2026-9501

Immediate Actions Required

Apply commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 from the upstream LibreDWG repository or upgrade to a release that contains the fix
Restrict execution of dwgread and other LibreDWG-based utilities to trusted local users only
Quarantine DWG files from untrusted sources until they have been validated by a patched parser

Patch Information

The LibreDWG maintainers committed the fix as e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. The patch introduces bounds checks for end, pos, and comp_offset against dec->size, returning DWG_ERR_VALUEOUTOFBOUNDS when invalid values are encountered. See the GitHub Issue Discussion and the VulDB Vulnerability Entry for additional context.

Workarounds

Run dwgread inside a sandbox or container so that an assertion-driven crash does not affect other workloads
Filter DWG files through a size and structure validator before they reach the vulnerable decoder
Disable automated DWG ingestion services until patched binaries are deployed across the environment

bash

# Build LibreDWG from source with the upstream fix applied
git clone https://github.com/LibreDWG/libredwg.git
cd libredwg
git checkout e501cb9926c1e9a07a0d1cc997f3e69e9be801c9
./autogen.sh
./configure --disable-bindings
make && sudo make install

# Verify the installed version no longer crashes on the public PoC
dwgread /path/to/suspect.dwg >/dev/null 2>&1; echo "exit=$?"