CVE-2026-90622 Details
Description
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.14 will fix this issue. The patch is named f5b548c4c1697d66c3dabd0f6a49280a14365a3a. The affected component should be upgraded. The FIELD_HANDLE macro itself is NULL-safe (emits null_handle) - only the two raw zeroing assignments added by 27118c40 ("encode: also disable LAYER.material") dereferenced a NULL material handle; the fix restores the file's existing if (_obj->style) guard convention for material.
A null pointer dereference vulnerability has been identified in GNU Libredwg version 0.13.4, specifically within the Layer Encoding component. The issue arises in the DWG_TABLE function of the src/dwg.spec file, where the LAYER material handle is accessed without proper null checks. This flaw leads to a segmentation fault, as the encoder attempts to write to a null pointer. The vulnerability can be exploited locally, and a public exploit is available.
Users are advised to upgrade to GNU Libredwg version 0.14, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LibreDWG/libredwg/issues/1269 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LibreDWG/libredwg/commit/f5b548c4c1697d66c3dabd0f6a49280a14365a3a | [email protected] | Source CodeVendor |
| https://github.com/LibreDWG/libredwg/issues/1269 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LibreDWG/libredwg/releases/tag/0.14 | [email protected] | Release NotesVendor |
| https://github.com/user-attachments/files/28549357/repro.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-90622 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/914770 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403204 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403204/cti | [email protected] | AdvisoryPermission Required |
| https://www.gnu.org/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GNU LibreDWG | 0.13.4.8229 (git 9b4adcbf, 2026-06-01) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |