CVE-2026-9529: GNU LibreDWG Null Pointer Vulnerability

CVE-2026-9529 Overview

CVE-2026-9529 is a null pointer dereference vulnerability in GNU LibreDWG versions up to 0.14. The flaw resides in the match_BLOCK_HEADER function within dwggrep.c, part of the Dwggrep Utility component. An attacker with local access and low privileges can trigger the dereference by supplying a crafted DWG file, causing the utility to crash. The issue is tracked under CWE-404 (Improper Resource Shutdown or Release). Public proof-of-concept material has been released, increasing the likelihood of opportunistic exploitation against systems that process untrusted DWG content.

Critical Impact
Local attackers can crash the Dwggrep utility by supplying a malformed DWG file, producing a denial-of-service condition in workflows that parse untrusted CAD files.

Affected Products

GNU LibreDWG versions up to and including 0.14
Dwggrep Utility (dwggrep.c) shipped with affected LibreDWG releases
Downstream tools and scripts that invoke Dwggrep against untrusted DWG input

Discovery Timeline

2026-05-26 - CVE-2026-9529 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9529

Vulnerability Analysis

The defect occurs in match_BLOCK_HEADER, a routine in dwggrep.c responsible for matching block header records inside DWG files. When the function processes a crafted DWG, an expected object pointer is left unset and subsequently dereferenced without a prior null check. The dereference terminates the running Dwggrep process. Because Dwggrep runs in the context of the invoking user, the resulting condition is limited to availability impact on the local utility rather than data confidentiality or integrity loss.

The weakness is classified under CWE-404. Public technical material is available in the LibreDWG issue tracker and the VulDB Vulnerability Report.

Root Cause

The root cause is missing input validation on object references parsed from DWG block header structures. The function assumes that header lookups always return a valid object pointer. When a malformed or truncated DWG omits or corrupts the referenced block header, the pointer remains null and the subsequent field access triggers the dereference.

Attack Vector

Exploitation requires local access and an authenticated low-privileged account. The attacker delivers a crafted DWG file and induces a user or automated job to run dwggrep against it. A public proof-of-concept DWG sample demonstrates the crash condition. Remote exploitation over a network path is not in scope for this CVE.

// No verified exploit code is available. The crash is reproduced by
// invoking: dwggrep <pattern> <crafted.dwg>
// where the supplied DWG omits a valid BLOCK_HEADER object reference,
// causing match_BLOCK_HEADER() in dwggrep.c to dereference a NULL pointer.

Detection Methods for CVE-2026-9529

Indicators of Compromise

Unexpected dwggrep process termination with SIGSEGV on hosts that parse user-supplied DWG files
Core dumps referencing match_BLOCK_HEADER in dwggrep.c
DWG files matching the published proof-of-concept hash from the HackC0der CVE-Repos

Detection Strategies

Monitor for repeated crashes of dwggrep or LibreDWG-linked binaries in system journals and coredumpctl output
Scan file ingestion pipelines for DWG inputs that fail header validation prior to passing them to LibreDWG utilities
Inventory hosts running LibreDWG <= 0.14 and flag them for review until patched

Monitoring Recommendations

Forward auditd, journald, and core dump telemetry from CAD processing hosts to a centralized log platform for correlation
Alert on abnormal exit codes from batch jobs invoking dwggrep against external DWG content
Track the upstream LibreDWG issue 1247 for fix availability and update detection rules accordingly

How to Mitigate CVE-2026-9529

Immediate Actions Required

Restrict dwggrep execution to trusted DWG inputs and remove the utility from automated pipelines that process untrusted files
Identify all hosts running GNU LibreDWG <= 0.14 and schedule them for update once an upstream fix is released
Run LibreDWG utilities under a low-privileged service account isolated from sensitive data

Patch Information

No vendor patch has been referenced in the NVD entry at the time of publication. Track the LibreDWG GitHub issue 1247 and the GNU project site for fix availability. Rebuild and redeploy LibreDWG from source once a corrected match_BLOCK_HEADER implementation is committed upstream.

Workarounds

Validate DWG files with a hardened parser or sandboxed converter before invoking dwggrep
Wrap dwggrep execution in a resource-limited container or systemd unit that contains crashes and prevents cascading failures
Disable or remove dwggrep on production hosts that do not require ad hoc DWG searching

bash

# Example: contain dwggrep using a restricted systemd-run scope
systemd-run --scope --uid=dwguser --gid=dwguser \
  --property=MemoryMax=256M \
  --property=NoNewPrivileges=yes \
  --property=ProtectSystem=strict \
  dwggrep "pattern" /var/cad/input/sample.dwg