Null Pointer Dereference in GNU LibreDWG Utility
CVE-2026-9529

4.8MEDIUM

Key Information:

Vendor

Gnu
Status
Libredwg
Vendor
CVE Published:
26 May 2026

Badges

👾 Exploit Exists

What is CVE-2026-9529?

A security flaw in GNU LibreDWG affects the dwggrep utility, specifically in the match_BLOCK_HEADER function of dwggrep.c. This vulnerability leads to a null pointer dereference, allowing local attackers to manipulate the functionality. An exploit has been publicly released, highlighting the risk associated with using this flawed version of the software. It is crucial for users to evaluate their systems and apply necessary patches or updates to mitigate potential attacks.

Affected Version(s)

LibreDWG 0.1

LibreDWG 0.2

LibreDWG 0.3

References

https://vuldb.com/vuln/365548
vdb-entrytechnical-description
https://vuldb.com/vuln/365548/cti
signaturepermissions-required
https://vuldb.com/submit/814273
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

pwn3rd (VulDB User)
.