LibreCAD: Heap out-of-bounds write in DWG parser (libdxfrw)
Summary
LibreCAD up to version 2.2.1.6 contains a heap-based out-of-bounds write in the bundled libdxfrw library, in the DWG R2004 page parser (dwgReader18::parseDataPage). A crafted DWG file with manipulated page offsets makes the decompression routine write beyond a heap buffer when the file is opened. An attacker can cause crashes and potentially execute code, but the attack requires a user to open the malicious file.
Affected
- LibreCAD through 2.2.1.6 (CVE record)
- Upstream report reproduced in 2.2.0, 2.2.1.5 and 2.2.1.6
- NVD analysis pending
Fixed in
Unknown.
- A backport fix is proposed in PR #3257, but no merge or fixed release was confirmed at the time of research.
Workaround
- No vendor-published workaround found.
- Do not open DWG files from unknown or untrusted senders.
- Ask external partners to send DXF files where possible.
- Run LibreCAD under a non-administrative account.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found; details were reported privately to the maintainers.
Our recommendation
- Treat DWG files from external parties as untrusted and open them only after verification.
- Identify workstations where LibreCAD is used with external CAD files.
- Monitor the LibreCAD releases page and PR #3257 and apply the update as soon as a fixed build is available.
- Check the NVD entry for the final analysis.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
zeetee1235/CVE-2026-126497
Research sources
- VulnCheck advisory www.vulncheck.com
- LibreCAD issue #3256 github.com
- LibreCAD pull request #3257 (fix) github.com
- LibreCAD releases github.com
- LibreCAD upstream commit referenced in CVE github.com
- dwgreader18.cpp at v2.2.1.6 github.com
- LibreCAD project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:23.
Original description (NVD)
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
NVD references (5)
- https://github.com/LibreCAD/LibreCAD
- https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173
- https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6
- https://github.com/LibreCAD/LibreCAD/issues/3256
- https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsed…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.