Vulnerability · Published May 26, 2026 · Assigned by VulDB

CVE-2026-9605GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

High 7.3

In plain English

A high-severity heap buffer overflow in libredwg from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
GNU	libredwg	0.13.4.8160

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-365678 | GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow vdb-entry, technical-description
VDB-365678 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #818197 | LibreDWG libredwg (including the dwgbmp utility) 0.13.4.8160 Buffer Overflow third-party-advisory
https://github.com/LibreDWG/libredwg/issues/1248 issue-tracking
https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg exploit
https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300 patch
https://www.gnu.org/ broken-link, product