CVE-2026-9504
BaseFortify
Publication date: 2026-05-25
Last updated on: 2026-05-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnu | libredwg | to 0.14 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the GNU LibreDWG software up to version 0.14, specifically in the function bit_convert_TU within the file programs/dwggrep.c of the Dwggrep Utility component.
The issue is an out-of-bounds read caused by improper manipulation in that function.
An attacker must have local access to launch the attack exploiting this vulnerability.
The exploit code for this vulnerability has been made publicly available.
Applying the provided patch is recommended to fix this issue.
How can this vulnerability impact me? :
This vulnerability allows an attacker with local access to cause an out-of-bounds read in the affected software.
Such out-of-bounds reads can potentially lead to information disclosure or cause the program to behave unexpectedly.
However, the CVSS scores indicate a low severity impact, with no direct impact on integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
The recommended action to fix this issue is to apply the patch identified as be996bf2178a40e98720f18c2414815d244413db.
Since the attack needs to be launched locally, limiting local access to trusted users may also help mitigate risk until the patch is applied.