CVE-2026-9605: GNU libredwg Buffer Overflow Vulnerability

CVE-2026-9605 Overview

CVE-2026-9605 is a heap-based buffer overflow vulnerability in GNU LibreDWG, an open-source library for reading and writing DWG CAD files. The flaw affects versions up to 0.13.4.8160 and resides in the bit_read_RC function within bits.c, exercised through the Dwgbmp utility. An attacker can trigger memory corruption by supplying a malformed DWG file, with exploitation possible remotely when the library processes untrusted input. A public proof-of-concept exists, and the upstream project has issued patch commit 8f03865f37f5d4ffd616fef802acc980be54d300 to address the issue [CWE-119].

Critical Impact

Processing a crafted DWG file via LibreDWG triggers a heap out-of-bounds read/write, leading to potential memory corruption, denial of service, or arbitrary code execution in applications embedding the library.

Affected Products

• GNU LibreDWG up to and including version 0.13.4.8160
• The Dwgbmp utility component that invokes bit_read_RC in bits.c
• Downstream CAD tools and converters that link against vulnerable LibreDWG builds

Discovery Timeline

• 2026-05-27 - CVE-2026-9605 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9605

Vulnerability Analysis

The vulnerability stems from inadequate bounds validation while decompressing DWG 2004-format compressed sections. The bit_read_RC primitive in bits.c reads a single byte from the active bitstream. When the surrounding decompression logic computes an out-of-range source or destination offset, bit_read_RC operates outside the allocated heap buffer. A specially crafted compressed section header passes the existing size checks but produces an address + size value that exceeds the decompressed buffer, resulting in a heap out-of-bounds read and write.

The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Because LibreDWG is widely embedded in CAD viewers, converters, and automation pipelines, any workflow that ingests untrusted DWG files inherits the exposure.

Root Cause

The root cause is missing validation of the decompressed-section address against the maximum decompressed size and the destination buffer length. The pre-patch code checked es.fields.address + size > max_decomp_size but did not verify es.fields.address itself, nor confirm the address plus size remained within the actual destination buffer (dec.size). A crafted file with an oversized es.fields.address bypasses the partial check and steers byte-level reads via bit_read_RC beyond heap boundaries.

Attack Vector

Exploitation requires an attacker to deliver a malicious DWG file to a victim who opens it with a tool linked against vulnerable LibreDWG. No authentication or user privileges are required beyond opening the file. The public proof-of-concept demonstrates triggering the overflow with a 2004-format compressed section.

               = MIN ((BITCODE_RL)(info->size - es.fields.address),
                      es.fields.page_size);
           if (info->compressed == 2 || bytes_left < 0
+              || es.fields.address > max_decomp_size
               || es.fields.address + size > max_decomp_size
+              || es.fields.address + size > dec.size
               || offset + size > dat->size)
             {
               LOG_ERROR ("Some section size or address out of bounds");

Source: GitHub Commit 8f03865 — the patch adds two boundary checks that reject oversized es.fields.address values and addresses that overrun the destination buffer.

Detection Methods for CVE-2026-9605

Indicators of Compromise

• Crashes or abort signals from processes invoking dwgbmp, dwgread, or other LibreDWG-linked binaries when parsing DWG inputs
• AddressSanitizer or Valgrind reports flagging heap-buffer-overflow in bit_read_RC or surrounding decode routines
• Presence of DWG samples matching the public PoC pattern documented in the GitHub PoC Repository

Detection Strategies

• Inventory all systems and container images that bundle libredwg shared objects or static libraries and compare versions against 0.13.4.8160
• Enable compiler hardening (-fstack-protector-strong, -D_FORTIFY_SOURCE=2, ASan in test builds) to surface overflow conditions during ingestion of DWG files
• Use file-content inspection at email and web gateways to flag DWG attachments originating from untrusted senders

Monitoring Recommendations

• Alert on unexpected termination of CAD conversion services or batch processors that parse DWG files
• Forward process crash telemetry and core-dump metadata to a centralized SIEM for correlation with file ingest events
• Track package versions via software composition analysis (SCA) to detect vulnerable LibreDWG builds in CI/CD pipelines

How to Mitigate CVE-2026-9605

Immediate Actions Required

• Apply the upstream patch commit 8f03865f37f5d4ffd616fef802acc980be54d300 or upgrade to a LibreDWG release that includes this fix
• Rebuild and redistribute downstream packages, container images, and CAD tools that statically or dynamically link against LibreDWG
• Restrict ingestion of DWG files from untrusted sources until patched binaries are deployed

Patch Information

The LibreDWG maintainers committed the fix as 8f03865f37f5d4ffd616fef802acc980be54d300 in src/decode.c. The patch adds explicit checks that reject decompressed section addresses exceeding max_decomp_size and that overrun the destination buffer dec.size. Review the GitHub Issue Discussion #1248 and the VulDB #365678 entry for additional context.

Workarounds

• Process DWG files in sandboxed environments such as containers with seccomp profiles or short-lived virtual machines to contain potential exploitation
• Disable or gate the dwgbmp utility from automated processing of externally sourced files
• Validate DWG file provenance and apply allow-lists for trusted CAD origins prior to parsing

# Build LibreDWG from source with the security patch applied
git clone https://github.com/LibreDWG/libredwg.git
cd libredwg
git checkout 8f03865f37f5d4ffd616fef802acc980be54d300
./autogen.sh
./configure --enable-write CFLAGS="-O2 -D_FORTIFY_SOURCE=2 -fstack-protector-strong"
make && sudo make install
ldconfig