Every CVE Search/ Get API key

CVE-2026-15184

GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference

4.8 Medium

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.17%Up 0.1 points since Jul 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Record
CVE-2026-15184
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-476, CWE-404
Updated
2026-11-02
EUVDEUVD-2026-42581 4.8

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Record
EUVD-2026-42581
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-fgx7-4whx-rx6p 1.9

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function...

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Record
GHSA-fgx7-4whx-rx6p
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
NVD 1.9

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Record
CVE-2026-15184
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSV 1.9

GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Record
CVE-2026-15184
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSVopenSUSE-SU-2026:11247-1 No score

libredwg-devel-0.14.8413-1.1 on GA media

These are all security issues fixed in the libredwg-devel-0.14.8413-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11247-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21346-1 No score

Security update for libredwg

This update for libredwg fixes the following issues:

Changes in libredwg:

  • Update to snapshot 0.14.8413

    • fix dwg_next_entity NULL pointer dereference [CVE-2026-15184, boo#1271170]
    • Fix dwg_bmp thumbnail overflow checks [CVE-2026-15181, boo#1271169]
    • Resolve NULL pointer dereference (SEGV) in match_BLOCK_HEADER [CVE-2026-9529, boo#1266380]
    • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
    • Minor features:
    • R2007+ split string stream encoding for Header, Classes, and objects.
    • Added cycle checks in entity link chains.
    • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
    • dwgfuzz: show mode with --version.

  • update to 0.14:

    • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
    • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
    • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
    • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
    • R2007+ split string stream encoding for Header, Classes, and objects.
    • Added cycle checks in entity link chains. GH #1226.
    • Added regression tests for decompress_r2007 OOB reads and R2004 section decompression. Added dwgfilter.test.
    • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
    • dwgfuzz: show mode with --version.
    • API/ABI changes (source-incompatible):
    • Renamed HEADER/2NDHEADER.is_maint to maint_rel_version.
    • Renamed PROXY_OBJECT.dwg_versions.
    • Bumped SO_VERSION to 0:14:0.

  • Update to snapshot 0.13.4.8200

    • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
    • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
    • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
    • Fix decompress_R2004_section buffer overflow [CVE-2026-9501, CVE-2026-9502, CVE-2026-9529, CVE-2026-9530, boo#1266377, boo#1266378, boo#1266380, boo#1266287]
    • Fix dwg_next_entity NULL pointer dereference [CVE-2026-9503, boo#1266379]
    • Fix NULL pointer dereferences in DXF output for corrupted DWG input [CVE-2026-9504, boo#1266321]
    • decode: fix decompression overflow [CVE-2026-9605, boo#1266365]
Record
openSUSE-SU-2026:21346-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libredwg
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.14.8413-1.1
0.14.8413-1.1
libredwg
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 0.14.8413-bp160.1.1
0.14.8413-bp160.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15184 is a medium vulnerability (CVSS 4.8) in Gnu Libredwg, published July 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open