CVE-2026-126497
LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
| CWE | CWE-787 |
| Vendor | librecad |
| Product | librecad |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for librecad librecad
Be the first to know when new high vulnerabilities affecting librecad librecad are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
LibreCAD / LibreCAD
0 ≤ 2.2.1.6
References
github.com: https://github.com/LibreCAD/LibreCAD/issues/3256 github.com: https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6 github.com: https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173 github.com: https://github.com/LibreCAD/LibreCAD vulncheck.com: https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage
Credits
Lee Keon-Hyeong Park-Jung-Hyun dxli