CVE-2026-9503 GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference
A local attacker can cause a denial of service via null pointer dereference in GNU LibreDWG when processing malicious DWG files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9503?
CVE-2026-9503 is a medium-severity vulnerability in GNU LibreDWG, published on 25 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 8f03865f37f5d4ffd616fef802acc980be54d300. Upgrading the affected component is advised.
Which versions are affected by CVE-2026-9503?
How do I fix CVE-2026-9503?
Apply the vendor's patch.
Is CVE-2026-9503 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9503 exists.
Sources
Also known as GHSA-q6j5-wxg6-4vrv.