Is CVE-2026-9504 actively exploited?

No active exploitation of CVE-2026-9504 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9504 be exploited remotely?

No. CVE-2026-9504 requires local access to exploit.

What is the CVSS score of CVE-2026-9504?

CVE-2026-9504 has a CVSS score of 3.3 (LOW).

HOME VULNERABILITIESCVE-2026-9504

LOW

CVE-2026-9504

CWE-119Published: May 25, 2026· Updated: May 26, 2026

3.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.8th

Official Description

A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.

NVD Source

Technical Analysis

CVE-2026-9504 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.