Is CVE-2026-9502 actively exploited?

No active exploitation of CVE-2026-9502 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9502 be exploited remotely?

No. CVE-2026-9502 requires local access to exploit.

What is the CVSS score of CVE-2026-9502?

CVE-2026-9502 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-9502

MEDIUM

CVE-2026-9502

CWE-119Published: May 25, 2026· Updated: May 26, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.1th

Official Description

A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. To fix this issue, it is recommended to deploy a patch.

NVD Source

Technical Analysis

CVE-2026-9502 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.