CVE-2026-126497 | BDVDB-2026-404828 Detail
LibreCADLibreCAD
Description#
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
- CWE-787 Out-of-bounds Write
References#
- https://github.com/LibreCAD/LibreCAD/issues/3256
- https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6
- https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173
- https://github.com/LibreCAD/LibreCAD
- https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.