Attack Chain

1. An attacker crafts a malicious DWG file containing a specially formatted bitmap (BMP) image.
2. The victim opens the malicious DWG file using an application that utilizes the vulnerable GNU libredwg library.
3. The Dwgbmp Utility component of libredwg attempts to process the embedded BMP image.
4. The bit_read_RC function in bits.c is called during the processing of the bitmap data.
5. Due to insufficient bounds checking, the bit_read_RC function writes data beyond the allocated buffer on the heap.
6. This heap-based buffer overflow corrupts adjacent memory regions, potentially overwriting critical data structures.
7. The memory corruption leads to a crash or, with carefully crafted input, allows the attacker to execute arbitrary code.
8. The attacker gains control of the application, potentially compromising the entire system.

Impact

Successful exploitation of CVE-2026-9605 can lead to arbitrary code execution on the victim’s system. This could allow an attacker to install malware, steal sensitive data, or take complete control of the affected machine. The vulnerability affects any application that uses the vulnerable versions of GNU libredwg to process DWG files.

Recommendation

• Apply the patch 8f03865f37f5d4ffd616fef802acc980be54d300 provided by GNU to remediate CVE-2026-9605.
• Monitor process creation events for applications using libredwg that spawn child processes (see Sigma rule “Detect Suspicious libredwg Process Creation”).
• Deploy the Sigma rule “Detect DWG File Processing with Unusual Arguments” to identify potential exploitation attempts through suspicious command-line arguments when processing DWG files.