Description

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.14 will fix this issue. The patch is named f5b548c4c1697d66c3dabd0f6a49280a14365a3a. The affected component should be upgraded. The FIELD_HANDLE macro itself is NULL-safe (emits null_handle) - only the two raw zeroing assignments added by 27118c40 ("encode: also disable LAYER.material") dereferenced a NULL material handle; the fix restores the file's existing if (_obj->style) guard convention for material.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T04:16:35.913Z",
  "pubdate": "2026-09-14T04:16:35.913Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in GNU libredwg version 0.13.4 within the Layer Encoding component.\nThe flaw originates from improper handling of object material handles during the encoding process defined in src/dwg.spec.\nSuccessful exploitation of this vulnerability results in a process crash, leading to a denial-of-service (DoS) condition.\nThe vulnerability is triggered locally, requiring an attacker to provide a specifically crafted DWG file for processing by the affected library.\nPublicly available exploit code increases the risk of exploitation for systems utilizing outdated versions of the library.\nThe risk is categorized as significant for applications relying on libredwg for parsing untrusted drawing files.\nRemediation requires upgrading to version 0.14, which incorporates the necessary null-check guards to ensure stability during object serialization.",
  "technicalDetails": "The vulnerability is situated within the DWG_TABLE function located in the src/dwg.spec file, specifically impacting the Layer Encoding functionality.\nThe root cause of the flaw is the improper assignment of raw handles following changes introduced in commit 27118c40 ('encode: also disable LAYER.material'). While the FIELD_HANDLE macro is designed to be null-safe by emitting a null_handle, the subsequent code changes bypassed this safety mechanism.\nSpecifically, two raw zeroing assignments were introduced that directly dereference a NULL material handle without verifying if the object's style attribute is initialized. This omission leads to an invalid memory access when the parser attempts to resolve or encode a null material pointer.\nThe attack flow requires an attacker to generate or supply a malicious DWG file containing a malformed layer structure that triggers the vulnerable codepath in the library. When the libredwg library processes this object during an encoding or export operation, the lack of validation for the _obj->style pointer causes the application to attempt to dereference a null pointer.\nThis behavior results in a segmentation fault, forcing the termination of the host process. Because this is a local exploit, it necessitates that the victim process the malicious file on a local system or within an application context where the library is leveraged for file conversion or data extraction.\nThe impact is primarily a denial-of-service, disrupting the availability of the application parsing the DWG data. While this specific flaw relates to a null pointer dereference, such memory management oversights can potentially be repurposed or leveraged within more complex exploit chains if the memory corruption is not immediately handled by an OS-level fault handler.\nThe fix, provided in patch f5b548c4c1697d66c3dabd0f6a49280a14365a3a, restores the mandatory guard check against _obj->style, ensuring that material handle operations are only executed if the object possesses a valid style reference, thereby maintaining memory safety during the encoding transition."
}