Every CVE Search/ Get API key

CVE-2026-9605

GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

6.9 MediumFix available

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.34%Up 0.3 points since May 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Record
CVE-2026-9605
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0
7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-122, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-32023 6.9

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Record
EUVD-2026-32023
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-9fj3-rp2j-9wq6 5.5

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function...

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Record
GHSA-9fj3-rp2j-9wq6
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 5.5

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Record
CVE-2026-9605
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119, CWE-122
Updated
2026-11-02
OSV 5.5

GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Record
CVE-2026-9605
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-122
Updated
2026-11-02
OSVopenSUSE-SU-2026:10879-1 No score

libredwg-devel-0.13.4.8200-1.1 on GA media

These are all security issues fixed in the libredwg-devel-0.13.4.8200-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10879-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21346-1 No score

Security update for libredwg

This update for libredwg fixes the following issues:

Changes in libredwg:

  • Update to snapshot 0.14.8413

    • fix dwg_next_entity NULL pointer dereference [CVE-2026-15184, boo#1271170]
    • Fix dwg_bmp thumbnail overflow checks [CVE-2026-15181, boo#1271169]
    • Resolve NULL pointer dereference (SEGV) in match_BLOCK_HEADER [CVE-2026-9529, boo#1266380]
    • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
    • Minor features:
    • R2007+ split string stream encoding for Header, Classes, and objects.
    • Added cycle checks in entity link chains.
    • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
    • dwgfuzz: show mode with --version.

  • update to 0.14:

    • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
    • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
    • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
    • Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf accept DXB input/output, and dxfwrite accepts DXB.
    • R2007+ split string stream encoding for Header, Classes, and objects.
    • Added cycle checks in entity link chains. GH #1226.
    • Added regression tests for decompress_r2007 OOB reads and R2004 section decompression. Added dwgfilter.test.
    • Added release helpers and improved CI (ODAFileConverter QT6, xvfb-run).
    • dwgfuzz: show mode with --version.
    • API/ABI changes (source-incompatible):
    • Renamed HEADER/2NDHEADER.is_maint to maint_rel_version.
    • Renamed PROXY_OBJECT.dwg_versions.
    • Bumped SO_VERSION to 0:14:0.

  • Update to snapshot 0.13.4.8200

    • Write support for r2004 (AC1018) DWG files. The encoder now produces compressed, encrypted section headers and the LZ77-compressed object data layout required since r2004.
    • Split large object files (encode, decode) into 2 objects, significantly reducing peak memory usage during compilation and enabling parallel builds to scale better.
    • dwgadd: handle fields (e.g. layer, ltype, style) can now be set by table-record name in addition to raw handle references. A string value like line.layer = "FOO" is resolved via dwg_find_tablehandle() at parse time.
    • Fix decompress_R2004_section buffer overflow [CVE-2026-9501, CVE-2026-9502, CVE-2026-9529, CVE-2026-9530, boo#1266377, boo#1266378, boo#1266380, boo#1266287]
    • Fix dwg_next_entity NULL pointer dereference [CVE-2026-9503, boo#1266379]
    • Fix NULL pointer dereferences in DXF output for corrupted DWG input [CVE-2026-9504, boo#1266321]
    • decode: fix decompression overflow [CVE-2026-9605, boo#1266365]
Record
openSUSE-SU-2026:21346-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libredwg
openSUSE:Tumbleweed
 before 0.13.4.8200-1.1
0.13.4.8200-1.1
libredwg
openSUSE:Leap 16.0
 before 0.14.8413-bp160.1.1
0.14.8413-bp160.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9605 is a medium vulnerability (CVSS 6.9) in Gnu Libredwg, published May 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in libredwg 0.13.4.8200-1.1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open