CVE-2026-111167: GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acdsprivate() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.
Affected Software
Event History
Frequently Asked Questions
Which files and tools are exposed to this issue?
The issue is triggered by crafted R2004 or R2010+ DWG files containing a large schdat property type value. It can crash dwgread, dwg2dxf, and any application that uses the affected LibreDWG decoder.
What does an attacker need to exploit it?
An attacker needs to cause a user or application to process a specially crafted supported DWG file. The supplied severity vector indicates local attack vector, no privileges required, and user interaction required.
What is the practical impact?
The unchecked schema property type index causes a read beyond a static table in acds_private(). This can disclose limited information and cause a denial of service by crashing the affected tool or application.