---
id: "CVE-2026-54610"
kind: "vulnerability"
aliases: ["CVE-2026-54610"]
title: "LibreDWG: DWG text conversion can write to immutable input, crashing apps"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "cad", "dwg", "libredwg", "package"]
not_affected_if: ["file-only-decode-export", "no-untrusted-input", "version-0.14-or-later"]
published_at: "2026-10-30T21:16:57+00:00"
first_seen_at: "2026-10-30T21:25:53+00:00"
updated_at: "2026-10-30T21:27:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54610", "first_seen_at": "2026-10-30T21:25:53+00:00"}]
---

# LibreDWG: DWG text conversion can write to immutable input, crashing apps

LibreDWG, a C library for reading and writing DWG drawing files, has a flaw in its text conversion function that writes into the caller's input buffer even though it is declared const. If that buffer is read-only, such as a string literal, the write can crash the application (denial of service), and mutable input can be silently modified.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LibreDWG version with `dwg2SVG --version` or the version of the linked libredwg library; versions before `0.14` are affected.
- Look for code calling `bit_TV_to_utf8()` that passes string literals or read-only memory and exposes it to untrusted input.

## Fix

- LibreDWG: move to `0.14` or later.

## Timeline

- 2026-10-30T21:25:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54610

## From the sources

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_