CVE-2026-15184: GNU LibreDWG Null Pointer Dereference Denial of Service

Technical summary

The vulnerability exists in the dwg_next_entity function located in src/dwg.c of the GNU LibreDWG DWG file handler component. The root cause is improper handling of the next_obj argument, which can be manipulated by a crafted DWG file to trigger a null pointer dereference condition. The flaw is classified under CWE-404 (Improper Resource Validation) and CWE-476 (Null Pointer Dereference), indicating insufficient validation of input parameters before dereferencing. Exploitation is limited to local attackers with the ability to load files, and requires no elevated privileges.

Business impact

Organizations using GNU LibreDWG for DWG file processing face application availability risk if users open untrusted or compromised DWG files. While data theft or system compromise is not possible through this vulnerability, repeated crashes could disrupt design workflows or document processing pipelines. The impact is primarily operational rather than security-critical, though organizations handling DWG files from external or untrusted sources should evaluate whether denial-of-service conditions pose business continuity concerns.

Affected systems

GNU LibreDWG library versions 0.13.4 and earlier are affected. Any application or service that embeds or uses LibreDWG for parsing DWG files is potentially at risk. This includes CAD software, file conversion utilities, and document processing systems that depend on this library. Version 0.14 and later are not affected.

Exploitability

The exploit proof-of-concept has been publicly disclosed, reducing the barrier to weaponization. However, exploitation requires local file system access and user action to open a malicious DWG file. The attack cannot be triggered remotely or without user interaction. The CVSS score of 3.3 (LOW) reflects these constraints: local attack vector, low privileges required, and no impact on confidentiality or integrity—only denial of service. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but public disclosure of the technique warrants prompt patching to prevent opportunistic exploitation.

Remediation

Upgrade GNU LibreDWG to version 0.14 or later. This version includes commit dde45dac3c4d902e4d8fed150a8017b9732019c9, which resolves the null pointer dereference. Organizations should verify the specific patch version against their vendor's advisory to ensure compatibility with dependent applications. If immediate upgrade is not possible, restrict access to untrusted DWG files and educate users not to open files from unverified sources.

Patch guidance

Apply GNU LibreDWG version 0.14 or later to all systems and applications using the library. Test the upgrade in a staging environment first to ensure compatibility with dependent CAD or document processing tools. Verify the installation includes commit dde45dac3c4d902e4d8fed150a8017b9732019c9. Check the vendor's release notes for any breaking changes or dependency updates. If your distribution or application vendor provides LibreDWG as a bundled dependency, coordinate with their release schedule; do not attempt manual patching unless explicitly supported.

Detection guidance

Monitor system logs for repeated application crashes or exceptions in processes that use LibreDWG, particularly when opening DWG files. Look for null pointer dereference errors in dwg_next_entity or related stack traces. File integrity monitoring can detect unauthorized DWG file modifications. Additionally, audit file access logs to identify attempts to open DWG files from suspicious sources. In a controlled environment, test parsing of known-malicious DWG samples (if available) against unpatched versions to confirm the crash behavior and validate that patched versions handle the input safely.

Why prioritize this

Although the CVSS score is LOW (3.3), this vulnerability merits timely attention because public exploit disclosure accelerates adoption by threat actors. Local attackers or malicious insiders could use a crafted DWG file to disrupt design workflows or trigger denial of service. Organizations with CAD environments, engineering teams, or document processing pipelines should prioritize patching to maintain operational continuity. The effort to upgrade is typically low, making it a high-return remediation action.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction beyond opening a file (UI:N), unchanged scope (S:U), and availability impact only (A:L). This translates to a LOW severity rating because the vulnerability cannot be exploited remotely, requires local access and a user to open a malicious file, and causes only a denial of service. However, the public disclosure of an exploit technique means real-world risk may exceed the base score in environments where insider threats or local file-sharing is common.

Frequently asked questions