{"id":"CVE-2026-126497","kind":"vulnerability","aliases":["CVE-2026-126497"],"related":[],"title":"LibreCAD: crafted DWG file overflows heap buffer, may run code","description":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.","summary":"LibreCAD through 2.2.1.6 bundles libdxfrw, whose DWG reader does not check buffer sizes and page offsets when parsing AC1018 (R2004) files. A malicious DWG file can make the parser write past a heap buffer, crashing LibreCAD and potentially running attacker code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"librecad","fixed":[],"affected":"<= 2.2.1.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["cad","desktop","dwg","libdxfrw","librecad","package"],"not_affected_if":["newer-version","no-dwg-files-opened","no-untrusted-dwg"],"how_to_check":"Run librecad --version or open Help > About; 2.2.1.6 or earlier is in range. Also check any package or build that vendors libdxfrw (libraries/libdxfrw/src/intern/dwgreader18.cpp) without commit 17ba2b2.","fix":"No fixed release named yet. Fix is commit 17ba2b2 (Bound R2004 DWG page decoding, #3257) on master, 2026-11-09; build from master or wait for a release after 2.2.1.6.","status":"open","published_at":"2026-11-11T01:17:14+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:25:50+00:00","updated_at":"2026-11-11T01:26:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T01:25:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"LibreCAD: crafted DWG file overflows heap buffer, may run code","impact":"high","summary":"LibreCAD through 2.2.1.6 bundles libdxfrw, whose DWG reader does not check buffer sizes and page offsets when parsing AC1018 (R2004) files. A malicious DWG file can make the parser write past a heap buffer, crashing LibreCAD and potentially running attacker code.","audience":"everyone","category":"package","nicknames":[],"who_cares":["librecad","libdxfrw","cad","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker code runs with the privileges of the LibreCAD user","analyst_note":"Confirm the fixed LibreCAD or libdxfrw version from the linked patch on github.com and the vulncheck advisory; the sources given do not name one.","how_to_check":"- Check the installed LibreCAD version with `librecad --version` or the About dialog; versions through `2.2.1.6` are in the affected range\n- Check whether the bundled libdxfrw is in use, for example in a build or package that vendors libdxfrw","plain_action":"If you use LibreCAD, update it once a fixed version is released; until then, do not open DWG files from unknown sources.","product_name":"","needs_analyst":true,"not_affected_if":["no-dwg-files-opened","newer-version"],"who_is_affected":"Anyone who opens DWG files in LibreCAD 2.2.1.6 or earlier, including files received by email or downloaded from the web. Systems that never open DWG files with LibreCAD are not exposed through this path.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4639,"output_tokens":628,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed LibreCAD or libdxfrw version from the linked patch on github.com and the vulncheck advisory; the sources given do not name one.","search":"'-126497':13A,16A '-2026':12A,15A '2.2.1.6':26B,67C 'ac1018':42B,98C 'attack':63B,94C 'base':72C 'bound':76C 'buffer':7A,35B,57B,89C,114C 'bundl':27B,81C 'cad':18B 'caus':107C,117C 'check':34B 'code':10A,64B,121C 'contain':68C 'craft':2A,96C 'crash':58B,118C 'cve':11A,14A 'decompress18':108C 'desktop':19B 'due':86C 'dwg':3A,20B,30B,47B,100C 'dwgreader18':83C 'execut':122C 'file':4A,44B,48B,101C 'function':85C 'heap':6A,56B,71C,113C 'heap-bas':70C 'libdxfrw':21B,28B,82C 'librecad':1A,17A,22B,24B,59B,65C 'make':50B 'malici':46B,103C 'may':8A 'offset':39B,93C 'open':116C 'out-of-bound':73C 'overflow':5A 'packag':23B 'page':38B,92C 'pars':41B 'parsedatapag':84C 'parser':52B 'past':54B,111C 'potenti':61B,120C 'r2004':43B,99C 'reader':31B 'run':9A,62B 'size':36B,90C 'startoffset':104C 'uncheck':88C 'valu':105C 'vulner':78C 'whose':29B 'write':53B,77C,110C","nicknames":[],"mitigations":[],"who_affected":"Anyone running LibreCAD 2.2.1.6 or earlier (reproduced on 2.2.0, 2.2.1.5, 2.2.1.6) who opens an untrusted AC1018 (R2004) DWG file. The bundled libdxfrw writes past a heap buffer, crashing the app and possibly running code. Skip it if you only open DWG files you made yourself, or do not use LibreCAD.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use LibreCAD, update it once a fixed version is released; until then, do not open DWG files from unknown sources.","pkeys":["librecad"],"ptokens":["librecad"],"labels":["cad","desktop","dwg","high","libdxfrw","librecad","package"],"campaign_type":null,"search_a":"'-126497':13A,16A '-2026':12A,15A 'buffer':7A 'code':10A 'craft':2A 'cve':11A,14A 'dwg':3A 'file':4A 'heap':6A 'librecad':1A,17A 'may':8A 'overflow':5A 'run':9A","search_b":"'2.2.1.6':26B 'ac1018':42B 'attack':63B 'buffer':35B,57B 'bundl':27B 'cad':18B 'check':34B 'code':64B 'crash':58B 'desktop':19B 'dwg':20B,30B,47B 'file':44B,48B 'heap':56B 'libdxfrw':21B,28B 'librecad':22B,24B,59B 'make':50B 'malici':46B 'offset':39B 'packag':23B 'page':38B 'pars':41B 'parser':52B 'past':54B 'potenti':61B 'r2004':43B 'reader':31B 'run':62B 'size':36B 'whose':29B 'write':53B","search_c":"'2.2.1.6':67C 'ac1018':98C 'attack':94C 'base':72C 'bound':76C 'buffer':89C,114C 'bundl':81C 'caus':107C,117C 'code':121C 'contain':68C 'craft':96C 'crash':118C 'decompress18':108C 'due':86C 'dwg':100C 'dwgreader18':83C 'execut':122C 'file':101C 'function':85C 'heap':71C,113C 'heap-bas':70C 'libdxfrw':82C 'librecad':65C 'malici':103C 'offset':93C 'open':116C 'out-of-bound':73C 'page':92C 'parsedatapag':84C 'past':111C 'potenti':120C 'r2004':99C 'size':90C 'startoffset':104C 'uncheck':88C 'valu':105C 'vulner':78C 'write':77C,110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126497","severity":null,"published_at":"2026-11-11T01:17:14+00:00","modified_at":"2026-11-11T01:17:14+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126497:3492","url":"https://github.com/LibreCAD/LibreCAD/issues/3256","severity":null,"published_at":"2026-11-11T01:26:18+00:00","modified_at":"2026-11-11T01:26:18+00:00","first_seen_at":"2026-11-11T01:26:18+00:00","fetched_at":"2026-11-11T01:26:18+00:00","note":"Read vulncheck advisory, issue #3256, commit 17ba2b2 (master, 2026-11-09, closed as fixed). No release version named; no exploitation seen, PoC sent privately. Fix release unknown; a tagged release would settle it. Nothing marked verified.","cites":["https://github.com/LibreCAD/LibreCAD/issues/3256"]}],"documents":[{"id":121277,"url":"https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121278,"url":"https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":121442,"url":"https://github.com/LibreCAD/LibreCAD/issues/3256","title":"libdxfrw heap-buffer-overflow in dwgReader18::parseDataPage() #3256","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}