Description
A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. A patch should be applied to remediate this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | LibreDWG | 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libredwg | 0.13.4.8200-1.1 | openSUSE-SU-2026:10879-1 |
| openSUSE Leap 16.0 | libredwg | 0.14.8413-bp160.1.1 | openSUSE-SU-2026:21346-1 |
Advisories 2
- openSUSE-SU-2026:21346-1 Security update for libredwg SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:10879-1 libredwg-devel-0.13.4.8200-1.1 on GA media SUSE / openSUSE Security Updates · May 29, 2026
References
- VDB-365483 | GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion vdb-entry technical-description
- VDB-365483 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #814250 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Reachable Assertion (CWE-617) third-party-advisory
- https://github.com/LibreDWG/libredwg/issues/1242 issue-tracking
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_assert_fail_decompress_R2004_section.dwg exploit
- https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 patch
- https://www.gnu.org/ product