CVE-2026-126497

high

Description

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.

References

https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage

https://github.com/LibreCAD/LibreCAD/issues/3256

https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6

https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173

https://github.com/LibreCAD/LibreCAD

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123062

Details

Source: Mitre, NVD

Published: 2026-11-11

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.5

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00171