CVE-2026-110606: LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of LibreCAD through 2.2.1.5 and libdxfrw through LC2.2.0 are exposed when they open or process a malicious DWG file using the affected reader.
What does an attacker need to exploit the vulnerability?
The attacker needs to provide a crafted AC1018, AC1024, or AC1027 DWG file whose decrypted header contains no NUL bytes. Exploitation requires user interaction to open or otherwise process that file.
What is the practical impact?
The out-of-bounds read can access adjacent stack memory and crash the affected process. The provided data does not indicate confidentiality or integrity impact.