CVE-2026-15182
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was found in GNU LibreDWG up to version 0.13.4 in the dwg_bmp function of src/dwg.c, part of the BMP Image Handler component. Manipulation leads to a heap-based buffer overflow. The attack requires local access and the exploit is publicly available.
Risk Assessment
The organization is at risk of local code execution or system crash by a user with access to BMP files. This vulnerability could be used for privilege escalation or destabilizing applications using LibreDWG.
Recommendation
Upgrade GNU LibreDWG to version 0.14 immediately or apply the patch with ID 18fd542bb4d5ccedf9de12052bf50068b2b26f06.
Other vulnerabilities in GNU LibreDWG
See all- CVE-2026-15184Low
A vulnerability was found in GNU LibreDWG up to version 0.13.4, involving a null pointer dereference in the dwg_next_entity function of src/dwg.c when processing the next_obj argument. The attack requires local access and the exploit has been made public.
- CVE-2026-15520Medium
A vulnerability was found in GNU LibreDWG 0.13.4-154-g0b573035 in the decompress_R2004_section function of src/decode.c. Manipulation can cause a heap-based buffer overflow.
- CVE-2026-9605High
GNU libredwg up to version 0.13.4.8160 contains a heap-based buffer overflow in the bit_read_RC function of bits.c in the Dwgbmp Utility component, which can be exploited remotely.
- CVE-2026-9530Low
In GNU LibreDWG up to 0.14, a vulnerability was found in the function read_2004_compressed_section of src/decode.c in the Dwgbmp Utility component. Manipulation can lead to out-of-bounds read. Local access is required.
- CVE-2026-9529Low
In GNU LibreDWG up to 0.14, a vulnerability was found in the function match_BLOCK_HEADER of dwggrep.c in the Dwggrep Utility component. Manipulation leads to null pointer dereference. Local access is required.
- CVE-2026-9504Low
A weakness has been identified in GNU LibreDWG up to version 0.14, affecting the bit_convert_TU function in programs/dwggrep.c of the Dwggrep Utility component. This manipulation causes an out-of-bounds read. The attack requires local access and the exploit has been made public.
- CVE-2026-9503Low
In GNU LibreDWG up to 0.14, a vulnerability was found in the function dwg_next_entity of src/decode.c in the DWG File Handler component. Manipulation leads to null pointer dereference. Local access is required.
- CVE-2026-9502Medium
A heap-based buffer overflow vulnerability was identified in GNU LibreDWG up to version 0.14 in the decompress_R2004_section function of the Dwgread Utility's src/decode.c file. The attack requires local access and the exploit is publicly available.
- CVE-2026-9501Low
In GNU LibreDWG up to 0.14, a vulnerability was found in the function decompress_R2004_section of src/decode.c in the Dwgread Utility component. Manipulation can lead to reachable assertion. Local access is required.
- CVE-2026-9500Medium
In GNU LibreDWG up to version 0.14, a vulnerability exists in the function read_2004_compressed_section in file src/decode.c of the Dwgread utility. Manipulation can lead to a heap-based buffer overflow. The attack requires local access and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.