Code Execution Vulnerability in LibreCad by LibreCAD Foundation
CVE-2021-21898

8.8HIGH

Key Information:

Vendor

Librecad

Status
Librecad
Vendor
CVE Published:
19 November 2021

What is CVE-2021-21898?

A vulnerability in the dwgCompressor::decompress18() functionality of LibreCad's libdxfrw allows for out-of-bounds write when processing specially-crafted .dwg files. An attacker can exploit this flaw by delivering a malicious file, potentially leading to arbitrary code execution. This risk underscores the importance of handling file inputs safely and the need for diligent patching practices in software development.

Affected Version(s)

LibreCAD LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.