CVE-2026-90622

Executive Summary

CVE-2026-90622 is a locally triggerable NULL pointer dereference in GNU libredwg 0.13.4, affecting the DWG_TABLE handling path in src/dwg.spec within the Layer Encoding component. A crafted DWG file processed by an affected build causes a NULL material handle to be dereferenced, leading to a crash (availability impact only). Because libredwg is a parsing library rather than a network service, exploitation is local: the attacker must induce a victim or automated pipeline to open a malicious DWG file using an affected build.

Technical Analysis

GNU libredwg is an open-source C library and set of utilities for reading and writing DWG (AutoCAD drawing) files. It is typically embedded in conversion pipelines, CAD tooling, forensic/analysis workflows, and file-processing daemons that ingest untrusted DWG content.

The defect sits in the DWG specification parser file src/dwg.spec, in the code path identified as function DWG_TABLE, under the Layer Encoding component. Per NVD, the root cause is narrow and well-bounded:

• The FIELD_HANDLE macro used by this parser is itself NULL-safe — it emits null_handle when it encounters a NULL handle, so the macro alone did not cause the fault.
• Commit 27118c40 ("encode: also disable LAYER.material") added two raw zeroing assignments that wrote through a handle field without first checking it. When a layer table record is parsed/encoded with a NULL material handle, those added assignments dereference NULL.
• The fix, commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a, restores the file's pre-existing guard convention — specifically the if (_obj->style) style NULL guard pattern — applied to material.

In practical terms: a DWG file whose LAYER table entry references a material handle that resolves to NULL places the parser in a state where the encoder path writes through an invalid pointer. The result is a crash (segmentation fault / abnormal termination). No memory corruption, type confusion, or code-execution primitive is described.

Attack surface. The attack surface is file parsing of untrusted DWG input. There is no network listener in libredwg itself; any remote exposure is indirect, via an application that accepts uploaded DWGs and calls libredwg (batch convertors, web CAD viewers, document-analysis pipelines, CI artifact scanners). The CVSS vector confirms this: AV:L (Local), AC:L (Low), PR:L (Low — the attacker needs the ability to supply a file to a process), UI:N, S:U (Unchanged scope), C:N/I:N/A:L — availability only, Low. There is no confidentiality or integrity impact described.

CWE note. The CVE record carries CWE-404 (Improper Resource Shutdown or Release). The NVD text describes a NULL pointer dereference, which maps more naturally to CWE-476. Analysts should treat CWE-404 as the assigned classification and CWE-476 as the descriptive defect class; the practical consequence (null dereference → crash) is unchanged.

Exploitation Scenarios

No functional PoC/exploit code is present in this dataset, and NVD states a public exploit exists but does not describe its contents. The following chain is therefore described at the vulnerability-class level; no function names, endpoints, or parameters beyond those appearing verbatim in the NVD description are assumed.

1) Reconnaissance / target identification. An attacker identifies a target that processes DWG files with an affected libredwg 0.13.4 build. Relevant targets are file-conversion services, CAD/drawing viewers accepting uploads, document-processing pipelines, and automated DWG ingestion in build or forensic tooling. Version fingerprinting is accomplished indirectly — by observing the importing application, its package manifest, or its reported version string — since libredwg exposes no network banner.

2) Triggering the flaw class. The attacker supplies a crafted DWG file as ordinary input (file upload, shared drawing, email attachment, drop folder). The trigger condition is structural: a LAYER table entry whose material handle is NULL enters the encoding path in DWG_TABLE in src/dwg.spec. Because the pre-patch code performed the zeroing assignment without the style-guard convention that the fix restores, the NULL handle is dereferenced. This is a crafted-malformed-file trigger, not a protocol or authentication bypass.

3) Payload / execution method. At the vulnerability-class level, no payload is required: the malformed input is the payload. The process consumes the file and dereferences NULL during table encoding. There is no described technique for controlled memory write or instruction-pointer control. An attacker can freely retry/modify the file (AC:L, UI:N), enabling rapid iteration and high reliability of the crash primitive.

4) Post-exploitation impact. The described outcome is denial of service — abnormal termination of the parsing process. Blast radius depends entirely on how the consuming application handles a worker crash: a sandboxed single-file converter loses one job; a monolithic service may lose the whole process; a batch pipeline may abort the run. No lateral movement, credential access, or data disclosure is implied by the CVE data. The realistic threat is availability and pipeline disruption, plus the operational cost of triage.

Impact Assessment

Severity: Low (CVSS 3.3). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L decomposes as:

• AV:L (Local): The attacker must be able to deliver a file to a process on the target — no network exploitation of libredwg itself.
• AC:L (Low): No special conditions beyond supplying the malformed DWG; trivial to attempt repeatedly.
• PR:L (Low): Some baseline privilege/access is required to supply input to the parsing process.
• UI:N (None): No human confirmation needed — a pipeline that auto-processes DWGs triggers without operator action.
• S:U (Unchanged): The crash does not cross a security boundary; only the vulnerable component is affected.
• C:N / I:N: No confidentiality or integrity impact described.
• A:L (Low): Availability impact is limited to disruption, not total loss.

Business impact. For organizations using libredwg inside automated DWG pipelines, the primary risk is service or job interruption and resource burn: cheap-to-produce malformed files can be used to repeatedly crash workers. In shared/CI environments this can stall build or conversion queues. There is no evidence in this record of data exfiltration, ransomware enablement, or supply-chain tampering. EPSS is 0.00161 (5.6th percentile), and CVE is not in CISA KEV — indicating low observed exploitation pressure despite public exploit availability.

Blast radius. Scaled by deployment: a single desktop CAD tool → one user session crash. A web upload converter with unsandboxed workers → repeated worker restarts / potential queue exhaustion. A monolith that links libredwg in-process → full-process termination per crafted file.

Detection Guidance

Sigma Rule

title: Suspicious libredwg DWG Parsing Crash / Null Dereference (CVE-2026-90622)
id: 3f2c1b9e-7a44-4d2e-9c1a-90622cve0001
status: experimental
description: Detects repeated abnormal termination of processes handling DWG files, consistent with a malformed LAYER.material NULL-handle dereference in libredwg 0.13.4.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90622
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/dwgread'
      - '/dwg2dxf'
      - '/dwg2SVG'
      - '/dwgrewrite'
      - '/dwgwrite'
  selection_crash:
    # Kernels/auditd may surface signal 11 (SIGSEGV) on process termination
    CommandLine|contains:
      - 'signal 11'
      - 'SIGSEGV'
  condition: selection_proc and selection_crash
falsepositives:
  - Genuine corrupted DWG files from non-malicious sources
  - Crash of unrelated DWG utilities sharing the same process name
level: low
tags:
  - attack.t1203

YARA Rule

rule CVE_2026_90622_libredwg_NULL_material_handle
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Heuristic detection of libredwg versions/builds not containing the CVE-2026-90622 material-handle guard fix"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-90622"
        cve         = "CVE-2026-90622"
        date        = "2026-01-01"

    strings:
        // Library self-identification present in libredwg binaries
        $lib = "libredwg" ascii wide
        // Parser specification marker artifact
        $spec = "dwg.spec" ascii wide
        // Downgrade/unfixed version marker
        $ver = "0.13.4" ascii wide
        // Table-encoding symbol referenced by the CVE text
        $tbl = "DWG_TABLE" ascii wide
        // NULL-safe handle macro referenced by the CVE text
        $fld = "FIELD_HANDLE" ascii wide

    condition:
        uint32(0) == 0x464C457F and        // ELF binary
        ($lib or $spec) and
        $ver and
        not $tbl and not $fld
}

Note: This YARA rule is a version/triage aid for identifying potentially unpatched builds on disk. It is deliberately conservative — it flags builds carrying the 0.13.4 marker alongside libredwg identifiers and avoids matching the fixed symbol-guard pattern. It does not parse DWG content and will not detect exploitation in transit.

Suricata IDS Rule

Because the vulnerability is file-parse triggered with no network protocol element, network detection is limited to observing delivery of DWG artifacts. The rule below alerts on DWG file transfer for triage correlation rather than direct exploitation.

alert http any any -> any any (msg:"CVE-2026-90622 Possible libredwg DWG Delivery (untrusted DWG transfer)"; flow:established,to_server; http.request_body; content:"AC10"; depth:1024; content:"DWG"; nocase; distance:0; content:"|00|"; within:16; classtype:attempted-dos; reference:cve,2026-90622; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90622; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:9062201; rev:1;)

The AC10 magic prefix corresponds to the DWG file signature family; analyst correlation with upload endpoints is expected. This rule does not confirm exploitation — it flags DWG-bearing uploads for follow-up.

Elastic Detection

sequence by host.id, process.parent.pid with maxspan=5m
  [ process where event.type == "start" and
      process.name in ("dwgread", "dwg2dxf", "dwgrewrite", "dwgwrite", "dwg2SVG") ]
  [ process where event.type in ("end", "stop") and
      (process.exit_code == 139 or event.action == "process_crashed") ]

Rule logic: correlate the launch of a libredwg utility with an abnormal termination whose exit code equals 139 (128 + SIGSEGV, the canonical segmentation-fault exit status on Linux). Two or more such correlations in quick succession on the same host warrants escalation as probable crafted-file DoS against CVE-2026-90622.

Splunk SPL Query

(index=linux_audit OR index=endpoint) sourcetype IN ("linux:audit","XmlWinEventLog","sysmon:linux")
| eval sig=coalesce(exit_code, exit_status, signal)
| where (sig="139" OR sig="11" OR sig="SIGSEGV" OR sig="segfault")
| search process_name IN ("dwgread","dwg2dxf","dwgrewrite","dwgwrite","dwg2SVG","dwg2dxf")
      OR process_commandline="*libredwg*"
| stats count AS crash_count, values(process_name) AS procs, values(process_commandline) AS cmds BY host, user
| where crash_count >= 3
| sort - crash_count

This query surfaces hosts exhibiting repeated libredwg-process segmentation faults, the operational fingerprint of a sustained CVE-2026-90622 crash loop.

Wazuh OSSEC Rule

<group name="libredwg,cve-2026-90622,">
  <rule id="906220" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">dwgread|dwg2dxf|dwgrewrite|dwgwrite|dwg2SVG</field>
    <field name="exit_code">139</field>
    <description>libredwg utility terminated by SIGSEGV (possible CVE-2026-90622 crafted DWG)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="906221" level="10" frequency="3" timeframe="300">
    <if_matched_sid>906220</if_matched_sid>
    <same_source_ip />
    <description>Repeated libredwg SIGSEGV crashes on same source - probable CVE-2026-90622 exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) asserts the fix; the patch commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a has not been independently confirmed in this dataset. Organizations should verify the commit against the upstream GNU libredwg repository before treating the issue as resolved.

1) Immediate mitigations

• For any workflow processing untrusted DWG content, wrap libredwg-based utilities in a sandbox / container with CPU, memory, and process-restart limits so a crash cannot wedge the parent service.
• Apply rate/size limits to DWG uploads and quarantine untrusted drawings for review rather than auto-ingesting.
• Run DWG conversion workers under unprivileged accounts with no access to sensitive paths or networks; treat the parser as hostile-input-facing.
• Monitor for the crash-loop signal (repeated SIGSEGV in libredwg utilities) as the operational indicator described in the detection rules above.

2) Patch / upgrade steps

• Upgrade GNU libredwg to 0.14, which NVD states fixes the issue.
• If tracking the source tree, confirm the presence of commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a, which restores the if (_obj->style) NULL-guard convention for material.
• Verify the previously-unfixed commit e3774bd4020fcfebb68150361db74b8b34d170fe is not the build you are shipping.

3) Long-term hardening

• Pin library versions with SBOMs and subscribe to OSV/GHSA feeds for libredwg; re-evaluate patch confidence once a second independent advisory or vendor advisory publishes recovery status.
• Adopt fuzzing (AFL++/libFuzzer) against the DWG parser in CI to catch regressions like the one introduced by commit 27118c40.
• Enforce least-privilege and process isolation for all file-parsing components, since CVSS indicates local, availability-only impact that scales sharply in automated pipelines.

References

1. NVD — CVE-2026-90622: https://nvd.nist.gov/vuln/detail/CVE-2026-90622
2. GNU libredwg upstream project / patch commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a (verify on the official libredwg repository)
3. OSV advisory entry for libredwg 0.13.4 (patch source cited in this dataset; single-source, claimed)
4. CISA Known Exploited Vulnerabilities Catalog — not listed as of report date (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. FIRST EPSS — CVE-2026-90622 score 0.00161, 5.6th percentile (https://api.first.org/data/v1/epss?cve=CVE-2026-90622)

Exploit-in-the-wild evidence: NVD states the exploit "has been released to the public," indicating public PoC availability; however, no exploit code, Nuclei template, or KEV entry is present in this dataset. No named threat actor campaigns are associated with CVE-2026-90622 in the provided intelligence. Treat the public-exploit claim as unverified pending a second source.