---
id: "CVE-2026-126497"
page: "https://infrastack.ai/live/CVE-2026-126497"
kind: "vulnerability"
aliases: ["CVE-2026-126497"]
title: "LibreCAD: crafted DWG file overflows heap buffer, may run code"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "librecad", "fixed": [], "affected": "<= 2.2.1.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cad", "desktop", "dwg", "libdxfrw", "librecad", "package"]
not_affected_if: ["newer-version", "no-dwg-files-opened", "no-untrusted-dwg"]
published_at: "2026-11-11T01:17:14+00:00"
first_seen_at: "2026-11-11T01:24:34+00:00"
updated_at: "2026-11-11T01:26:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126497", "first_seen_at": "2026-11-11T01:24:34+00:00"}, {"source": "analyst", "url": "https://github.com/LibreCAD/LibreCAD/issues/3256", "first_seen_at": "2026-11-11T01:26:18+00:00", "cites": ["https://github.com/LibreCAD/LibreCAD/issues/3256"]}]
exploit_sources: []
---

# LibreCAD: crafted DWG file overflows heap buffer, may run code

Link for people: https://infrastack.ai/live/CVE-2026-126497 (this .md is for agents)

LibreCAD through 2.2.1.6 bundles libdxfrw, whose DWG reader does not check buffer sizes and page offsets when parsing AC1018 (R2004) files. A malicious DWG file can make the parser write past a heap buffer, crashing LibreCAD and potentially running attacker code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:librecad affected <= 2.2.1.6 fixed no fixed version listed

## How to check

Run librecad --version or open Help > About; 2.2.1.6 or earlier is in range. Also check any package or build that vendors libdxfrw (libraries/libdxfrw/src/intern/dwgreader18.cpp) without commit 17ba2b2.

## Fix

No fixed release named yet. Fix is commit 17ba2b2 (Bound R2004 DWG page decoding, #3257) on master, 2026-11-09; build from master or wait for a release after 2.2.1.6.

## Timeline

- 2026-11-11T01:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126497
- 2026-11-11T01:26:18+00:00 analyst https://github.com/LibreCAD/LibreCAD/issues/3256 — Read vulncheck advisory, issue #3256, commit 17ba2b2 (master, 2026-11-09, closed as fixed). No release version named; no exploitation seen, PoC sent privately. Fix release unknown; a tagged release would settle it. Nothing marked verified.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage
- [describes] libdxfrw heap-buffer-overflow in dwgReader18::parseDataPage() #3256 https://github.com/LibreCAD/LibreCAD/issues/3256
- [fix] Patch: github.com https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6

## From the sources

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_