CVE-2026-9503
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
May 25, 2026
CISA due date
—
The record
A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 8f03865f37f5d4ffd616fef802acc980be54d300. Upgrading the affected component is advised.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | libredwg | 0 | 0.13.4.8200-1.1 |
Related vulnerabilities
- CVE-2026-9605 A flaw has been found in GNU libredwg up to 0.13.4.8160. Also affects libredwg
- CVE-2026-9504 A weakness has been identified in GNU LibreDWG up to 0.14. Also affects libredwg
- CVE-2026-9501 A vulnerability was determined in GNU LibreDWG up to 0.14. Also affects libredwg
- CVE-2026-109277 ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script… CWE-404
- CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. CWE-404
- CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. CWE-404