GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow

Vulnerability

A heap-based buffer overflow vulnerability exists in the read_2004_compressed_section function in src/decode.c of GNU LibreDWG, affecting versions up to 0.14 (including commit 6d6a339 on the main branch). The issue occurs when parsing malformed DWG R2004 input with the dwgread tool, leading to an out-of-bounds write during a memcpy/memmove operation [2].

Exploitation

An attacker with local access can exploit this vulnerability by supplying a specially crafted DWG file to the dwgread utility. The exploit has been publicly demonstrated, with a proof-of-concept file available [3]. No additional privileges or authentication are required beyond the ability to execute dwgread on the target system.

Impact

Successful exploitation causes a heap buffer overflow that results in a segmentation fault (SEGV) and denial of service. AddressSanitizer logs confirm a write access to an invalid heap location [2]. Depending on heap layout, an attacker may also achieve arbitrary code execution with the privileges of the user running dwgread.

Mitigation

As of the publication date, the LibreDWG project has not responded to the issue report and no patch has been released. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Users should avoid processing untrusted DWG files with dwgread until a fix is available.