Analyst readout for executives and security teams
Plain-English summary
CVE-2026-9529 is a crash flaw in GNU LibreDWG's dwggrep utility. A crafted or manipulated local use case can trigger a null pointer dereference and disrupt availability. The sources do not indicate data theft, remote compromise, or active exploitation, but they do state a public exploit exists.
Executive priority
Treat this as a moderate operational risk. Prioritize environments that process external CAD/DWG files or provide shared local access. It is not presented as a remote takeover issue, but public exploit availability justifies timely containment and vendor tracking.
Technical view
The flaw affects match_BLOCK_HEADER in dwggrep.c within GNU LibreDWG Dwggrep Utility up to 0.14. It is classified as CWE-476 and CWE-404, with CVSS 4.0 score 4.8. The vector is local, low complexity, low privileges, no user interaction, and low vulnerable-system availability impact.
Likely exposure
Exposure is mainly systems where GNU LibreDWG dwggrep is installed and callable by local users or automated DWG-processing jobs. Listed affected versions are 0.1 through 0.14. The supplied sources do not indicate internet-facing exposure or impact to other GNU components.
Exploitation context
The bundle states exploit material has been released publicly and may be used for attacks. KEV status is false, and no supplied source confirms active exploitation. The attacker needs local access and low privileges according to the CVSS vector.
Researcher notes
Evidence is sufficient for affected component, version range, weakness type, and local availability impact. Evidence is incomplete on a fixed release, practical exploit reliability, and real-world exploitation. Do not infer impact beyond dwggrep or GNU LibreDWG versions named in the sources.
Mitigation direction
- Inventory systems running GNU LibreDWG versions 0.1 through 0.14.
- Avoid processing untrusted DWG files with dwggrep until vendor guidance is confirmed.
- Restrict dwggrep execution to trusted users and controlled automation paths.
- Run DWG processing in a sandboxed or low-impact environment where practical.
- Monitor GNU LibreDWG and issue tracker references for an official fix or workaround.
Validation and detection
- Check installed LibreDWG versions against the affected range in the CVE record.
- Identify scheduled jobs, scripts, or user workflows that invoke dwggrep.
- Review crash logs for dwggrep failures during BLOCK_HEADER processing or DWG scanning.
- Confirm untrusted DWG files are not processed on production or shared systems.
- Track whether upstream issue 1247 or CVE records add patch information.
Public sources used
- CVE Program
- CVE List V5
- VDB-365548 | GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference
- VDB-365548 | CTI Indicators (IOB, IOC, IOA)
- Submit #814273 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) NULL Pointer Dereference (CWE-476)
- LibreDWG issue 1247
- Public exploit reference
- GNU
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-9529 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P — — VulDB CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C 1.8 1.4 VulDB CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C 1.8 1.4 VulDB AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C 3.1 2.9 VulDB Vulnerability scoring details
Base CVSS 4.0 score
4.8 MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
3.3 LowVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Base CVSS 3.0 score
3.3 LowVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Base CVSS 2.0 score
1.7 LowVector: AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline VulDB
Advisory disclosed
- Source timeline VulDB
VulDB entry created
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline VulDB
VulDB entry last update
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- VDB-365548 | GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference CVE reference, VulDB · vdb-entry, technical-description
- VDB-365548 | CTI Indicators (IOB, IOC, IOA) CVE reference, VulDB · signature, permissions-required
- Submit #814273 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) NULL Pointer Dereference (CWE-476) CVE reference, VulDB · third-party-advisory
- https://github.com/LibreDWG/libredwg/issues/1247 CVE reference, VulDB · issue-tracking
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg CVE reference, VulDB · exploit
- https://www.gnu.org/ CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.