DEBIAN-CVE-2026-126497: High severity debian/librecad vulnerability
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of LibreCAD through 2.2.1.6 are exposed when they open AC1018 (R2004) DWG files from untrusted or insufficiently trusted sources. The affected component is the bundled libdxfrw parser.
What must an attacker do to trigger the vulnerability?
An attacker must craft an AC1018 DWG file with malicious startOffset values. The issue is triggered when a user opens that file in LibreCAD.
Is user interaction required?
Yes. The supplied severity vector identifies user interaction as required, and the malformed DWG must be opened to reach the vulnerable parsing path.
What could happen if exploitation succeeds?
The out-of-bounds heap write can crash LibreCAD and may allow code execution. The provided severity data rates confidentiality, integrity, and availability impact as high.