CVE-2026-126497: LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of LibreCAD through version 2.2.1.6 are exposed when they open an attacker-crafted AC1018 (R2004) DWG file. Exploitation requires local interaction because the malicious file must be opened by the user.
What does an attacker need to exploit it?
An attacker needs to create a malicious AC1018 DWG file with crafted startOffset values. No prior privileges are required, but a user must open the file in the affected application.
What can be done if an update cannot be applied immediately?
Do not open untrusted or unsolicited AC1018 (R2004) DWG files in affected LibreCAD installations. Treat DWG files from unverified sources as potentially malicious until the installation can be updated.
How can I determine whether a file may trigger the issue?
The vulnerable parsing path applies to AC1018 (R2004) DWG files and malicious startOffset values. Determining whether an individual file contains exploit values requires inspecting its DWG page-offset data; opening it in an affected LibreCAD version may trigger the vulnerability.