ANT-2026-09SNWQBT · libredwg

use-after-free critical

Severity Claude critical · Security research firm critical · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-09SNWQBT: Use-after-free in libredwg

In LibreDWG's in_json.c, the EED (Extended Entity Data) parser assigns a local pointer data = obj->eed[i].data and then, in the case 3 branch, calls eed_need_size() which may realloc and move eed[i].data. The return value of eed_need_size is ignored and data is not refreshed, so the subsequent store data->u.eed_3.layer = json_long(...) writes into freed heap memory. An attacker who supplies a crafted DWG-JSON file with an EED array sized to force the realloc triggers a heap-use-after-free write. The crash reproduces regardless of the integer value written (tested with both 0xdeadbeef and 42), confirming the fault is structural rather than value-dependent.

Target

Project: libredwg

Technical Details

ASAN reports a heap-use-after-free WRITE at 0x5020000000f1. Root cause: eed_need_size performs realloc on eed[i].data (in_json.c:1494), potentially freeing the old allocation; the caller's local data pointer still references the freed block, and line 1649 dereferences it for a write. This is a classic stale-pointer-after-realloc bug; the written value is attacker-supplied JSON data but the faulting address is heap-internal, so this is a UAF write primitive rather than direct pointer control.

Crash trace:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3941514522
INFO: Loaded 1 modules   (684898 inline 8-bit counters): 684898 [0x5a610d18c810, 0x5a610d233b72), 
INFO: Loaded 1 PC tables (684898 PCs): 684898 [0x5a610d233b78,0x5a610dca7198), 
/out/llvmfuzz: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-09SNWQBT.

Reference: ANT-2026-09SNWQBT
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: critical

TIMELINE

Dates from discovery through public reveal.

2026-03-24 Reported to tracker
2026-05-07 Sent to maintainer
2026-05-12 Maintainer acknowledged
2026-05-15 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

1bcd96b33eaaaac19a4303cf040e6ff1e0dc4aa4c257462d65bbcf90deffd3f5f75bb7e596b1d20e58e246a8e50e9cecbba2d2ad07ebad86ab55751fc8e2b655

Committed 2026-05-07 14:16 PT

Revealed 2026-08-17 16:28 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-09SNWQBT",
  "bug_class": "Use-after-free",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:26:32+00:00",
  "description": "In LibreDWG's in_json.c, the EED (Extended Entity Data) parser assigns a local pointer `data = obj->eed[i].data` and then, in the `case 3` branch, calls `eed_need_size()` which may `realloc` and move `eed[i].data`. The return value of `eed_need_size` is ignored and `data` is not refreshed, so the subsequent store `data->u.eed_3.layer = json_long(...)` writes into freed heap memory. An attacker who supplies a crafted DWG-JSON file with an EED array sized to force the realloc triggers a heap-use-after-free write. The crash reproduces regardless of the integer value written (tested with both 0xdeadbeef and 42), confirming the fault is structural rather than value-dependent.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libredwg",
  "reproduction": null,
  "technical_details": "ASAN reports a heap-use-after-free WRITE at 0x5020000000f1. Root cause: `eed_need_size` performs `realloc` on `eed[i].data` (in_json.c:1494), potentially freeing the old allocation; the caller's local `data` pointer still references the freed block, and line 1649 dereferences it for a write. This is a classic stale-pointer-after-realloc bug; the written value is attacker-supplied JSON data but the faulting address is heap-internal, so this is a UAF write primitive rather than direct pointer control.",
  "title": "Use-after-free in libredwg",
  "vendor_severity": "critical"
}