CVE-2026-15182— GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15182
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-15182
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15182
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15182 (1)
Vendor Advisories for CVE-2026-15182 (1)
Proof of Concept for CVE-2026-15182 (2)
Vendor Pages for CVE-2026-15182 (2)
Same Patch Batch · GNU · 2026-07-09 · 4 CVEs total
| CVE-2026-15184 | 3.3 LOW | GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference |
| CVE-2026-56289 | Loop with Unreachable Exit Condition in GNU patch | |
| CVE-2026-56288 | NULL Pointer Dereference in GNU patch |
IV. Related Vulnerabilities
Same product: LibreDWG
- CVE-2026-15184
GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer der - CVE-2026-9605
GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based ov - CVE-2026-9530
GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_se - CVE-2026-9529
GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER nu - CVE-2026-9504
GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of
Same vendor: GNU
Same weakness: CWE-122
- CVE-2026-57156
FreeRDP: Integer overflow leading to heap buffer overflow in - CVE-2026-54000
osquery: Heap buffer overflow in `getProcessCurrentDirectory - CVE-2026-54001
osquery: Heap buffer overflow via `authenticode` table (Wind - CVE-2026-58306
Samsung Escargot堆缓冲区溢出漏洞 - CVE-2026-15174
Heap-based Buffer Overflow in Wireshark
V. Comments for CVE-2026-15182
No comments yet