GNU
GNU Libredwg: vulnerabilities and CVEs
GNU Libredwg has 100 published vulnerabilities, 13 of them in the last 12 months. 5 are rated critical and 0 are listed by CISA as actively exploited.
CVEs100
Last 12 months13
Critical5
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-90622 | Low (1.9) | 0.17% | — | Sep 14, 2026 | A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference.… |
| CVE-2026-15520 | Low (1.9) | 0.18% | — | Jul 13, 2026 | A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can… |
| CVE-2026-15184 | Low (1.9) | 0.17% | — | Jul 9, 2026 | A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj… |
| CVE-2026-15182 | Low (1.9) | 0.18% | — | Jul 9, 2026 | A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow.… |
| CVE-2026-9605 | Medium (5.5) | 0.57% | — | May 27, 2026 | A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is… |
| CVE-2026-9530 | Low (1.9) | 0.16% | — | May 26, 2026 | A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to… |
| CVE-2026-9529 | Low (1.9) | 0.16% | — | May 26, 2026 | A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component Dwggrep Utility. Performing a manipulation results in null… |
| CVE-2026-9504 | Low (1.9) | 0.16% | — | May 25, 2026 | A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack… |
| CVE-2026-9503 | Low (1.9) | 0.16% | — | May 25, 2026 | A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference.… |
| CVE-2026-9502 | Low (1.9) | 0.17% | — | May 25, 2026 | A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer… |
| CVE-2026-9501 | Low (1.9) | 0.16% | — | May 25, 2026 | A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to… |
| CVE-2026-9500 | Low (1.9) | 0.17% | — | May 25, 2026 | A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in… |
| CVE-2025-61154 | Medium (6.5) | 0.22% | — | Mar 12, 2026 | Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c. |
| CVE-2023-26157 | High (7.5) | 0.54% | — | Jan 2, 2024 | Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c. |
| CVE-2023-36274 | High (8.8) | 0.92% | — | Jun 23, 2023 | LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c. |
| CVE-2023-36273 | High (8.8) | 0.70% | — | Jun 23, 2023 | LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. |
| CVE-2023-36272 | High (8.8) | 0.92% | — | Jun 23, 2023 | LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c. |
| CVE-2023-36271 | High (8.8) | 0.92% | — | Jun 23, 2023 | LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c. |
| CVE-2023-25222 | High (8.8) | 0.81% | — | Mar 1, 2023 | A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c. |
| CVE-2022-45332 | High (7.8) | 0.31% | — | Nov 30, 2022 | LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c. |
| CVE-2022-35164 | Critical (9.8) | 1.0% | — | Aug 18, 2022 | LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. |
| CVE-2022-33034 | High (7.8) | 0.75% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy_bytes at decode_r2007.c. |
| CVE-2022-33033 | High (7.8) | 0.75% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg_read_file at dwg.c. |
| CVE-2022-33032 | High (7.8) | 0.75% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c. |
| CVE-2022-33028 | High (7.8) | 0.75% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg_add_object at decode.c. |
| CVE-2022-33027 | High (7.8) | 0.79% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c. |
| CVE-2022-33026 | High (7.8) | 0.75% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. |
| CVE-2022-33025 | High (7.8) | 0.79% | — | Jun 23, 2022 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c. |
| CVE-2022-33024 | High (7.5) | 1.1% | — | Jun 23, 2022 | There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608. |
| CVE-2021-42586 | High (8.8) | 1.0% | — | May 23, 2022 | A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file. |