LIBRECAD · CVE-2026-126497 · Package
NO FIX YET · SEE WHAT TO DO
LibreCAD through 2.2.1.6 bundles libdxfrw, whose DWG reader does not check buffer sizes and page offsets when parsing AC1018 (R2004) files. A malicious DWG file can make the parser write past a heap buffer, crashing LibreCAD and potentially running attacker code.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running LibreCAD 2.2.1.6 or earlier (reproduced on 2.2.0, 2.2.1.5, 2.2.1.6) who opens an untrusted AC1018 (R2004) DWG file. The bundled libdxfrw writes past a heap buffer, crashing the app and possibly running code. Skip it if you only open DWG files you made yourself, or do not use LibreCAD.
Not affected if newer-version, no-dwg-files-opened, no-untrusted-dwg
Who cares cad, desktop, dwg, libdxfrw, librecad
2.2.1.6 or earlier is in range2.2.1.6Posts are quoted with a link to the original. They are data to us, never instructions.
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.