CVE-2026-15182: GNU LibreDWG BMP Heap Buffer Overflow - MEDIUM CVSS 5.3

Technical summary

The vulnerability exists in the dwg_bmp function within src/dwg.c of GNU LibreDWG's BMP Image Handler component. A heap-based buffer overflow (CWE-119, CWE-122) occurs during BMP file processing, allowing an authenticated local attacker to write beyond allocated heap memory boundaries. The flaw requires local system access and standard user privileges to trigger; no user interaction is needed once exploitation begins. The patch commit 18fd542bb4d5ccedf9de12052bf50068b2b26f06 corrects the memory boundary checks in the affected function.

Business impact

Organizations using LibreDWG in design, CAD, or document conversion workflows may experience service disruption if an attacker exploits this flaw. A compromised process could leak sensitive design data, corrupt project files, or trigger denial of service. The impact is localized to systems where untrusted users can authenticate and submit BMP files for processing—typical in collaborative environments or batch processing services. The medium CVSS score reflects the local-only attack surface and limited confidentiality/integrity risk relative to remote or privilege-escalation flaws.

Affected systems

GNU LibreDWG library versions up to and including 0.13.4 are vulnerable. Any application that embeds or links LibreDWG and processes BMP image data is at risk if running on systems where local, authenticated users exist. This includes CAD applications, document converters, and design toolchains that rely on LibreDWG for DWG file manipulation and embedded image handling.

Exploitability

Exploitation requires local system access and valid user credentials; remote exploitation is not possible. The attacker must be able to supply a specially crafted BMP file to the affected dwg_bmp function. Public disclosure of the vulnerability has occurred, increasing the likelihood that exploit code or proof-of-concept demonstrations are available. However, the barrier to entry remains moderate due to the local-only requirement and the need to interact with the specific BMP processing code path.

Remediation

Upgrade GNU LibreDWG to version 0.14 or later. Organizations should verify patch applicability across their software supply chain, particularly in third-party applications that statically link or bundle older versions of the library. For systems unable to upgrade immediately, restrict local system access to trusted users only and monitor file upload or BMP processing endpoints for anomalies.

Patch guidance

The upstream fix is available in GNU LibreDWG version 0.14. Apply this update to all systems running vulnerable versions. The specific patch commit is 18fd542bb4d5ccedf9de12052bf50068b2b26f06; verify against the official LibreDWG repository that this commit is included in your target version. If LibreDWG is embedded in a third-party application, check the vendor's advisory for their release timeline and patch availability. Test the update in a non-production environment to confirm compatibility with dependent software before production deployment.

Detection guidance

Monitor system logs for failures or unexpected termination of processes that handle BMP file processing through LibreDWG. Heap corruption or segmentation faults in dwg_bmp may indicate exploitation attempts. Implement file-type validation to ensure only legitimate BMP files are processed; reject files with suspicious headers or oversized dimensions. Network detection is limited since the attack is local, but host-based intrusion detection rules for heap-spray patterns or buffer overflow signatures in memory may help identify post-exploitation activity. Review access logs to identify which local users interact with LibreDWG-dependent applications.

Why prioritize this

This vulnerability merits timely but not emergency patching. The CVSS 5.3 MEDIUM score and local-only attack surface mean it poses lower risk than remote code execution or privilege-escalation flaws. However, organizations with multi-user systems or CAD/design services should prioritize upgrades to close an avenue for lateral data theft or service disruption. The public disclosure of the vulnerability and availability of proof-of-concept code elevate the urgency moderately.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects: local attack vector only (AV:L), low complexity exploitation (AC:L), requirement for authenticated user privileges (PR:L), no user interaction needed once triggered (UI:N), and limited scope (S:U). The impact is confined to confidentiality, integrity, and availability within the vulnerable process—not system-wide. This scoring appropriately deprioritizes the flaw relative to remote or privilege-escalation vulnerabilities while recognizing the real risk in collaborative or multi-tenant environments.

Frequently asked questions