CVE-2026-9504

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

These are all security issues fixed in the libredwg-devel-0.13.4.8200-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libredwg fixes the following issues:

Changes in libredwg:

• Update to snapshot 0.14.8413

  • fix dwg_next_entity NULL pointer dereference [CVE-2026-15184, boo#1271170]
  • Fix dwg_bmp thumbnail overflow checks [CVE-2026-15181, boo#1271169]
  • Resolve NULL pointer dereference (SEGV) in match_BLOCK_HEADER [CVE-2026-9529, boo#1266380]
  • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
  • Minor features:
  • R2007+ split string stream encoding for Header, Classes, and objects.
  • Added cycle checks in entity link chains.
  • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
  • dwgfuzz: show mode with --version.

• update to 0.14:

  • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
  • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
  • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
  • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
  • R2007+ split string stream encoding for Header, Classes, and objects.
  • Added cycle checks in entity link chains. GH #1226.
  • Added regression tests for decompress_r2007 OOB reads and R2004 section decompression. Added dwgfilter.test.
  • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
  • dwgfuzz: show mode with --version.
  • API/ABI changes (source-incompatible):
  • Renamed HEADER/2NDHEADER.is_maint to maint_rel_version.
  • Renamed PROXY_OBJECT.dwg_versions.
  • Bumped SO_VERSION to 0:14:0.

• Update to snapshot 0.13.4.8200

  • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
  • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
  • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
  • Fix decompress_R2004_section buffer overflow [CVE-2026-9501, CVE-2026-9502, CVE-2026-9529, CVE-2026-9530, boo#1266377, boo#1266378, boo#1266380, boo#1266287]
  • Fix dwg_next_entity NULL pointer dereference [CVE-2026-9503, boo#1266379]
  • Fix NULL pointer dereferences in DXF output for corrupted DWG input [CVE-2026-9504, boo#1266321]
  • decode: fix decompression overflow [CVE-2026-9605, boo#1266365]