Stack-Based Out-of-Bounds Read in LibreCAD by LibreCAD
CVE-2026-110606

4.8MEDIUM

Key Information:

Vendor

Librecad

Status
Libdxfrw
Librecad
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110606?

LibreCAD's libdxfrw component, specifically versions up to 2.2.1.5, is susceptible to a stack-based out-of-bounds read due to improper handling of non-NUL-terminated buffers in the dwgReader18::readFileHeader() function. This vulnerability allows malicious actors to manipulate AC1018, AC1024, or AC1027 DWG files, potentially leading to unauthorized access to adjacent stack memory. Such exploitation could ultimately crash the application, highlighting the need for immediate patching and robust security measures.

Affected Version(s)

libdxfrw 0

LibreCAD 0 <= 2.2.1.5

References

https://github.com/LibreCAD/LibreCAD/issues/2554
issue-tracking
https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read
third-party-advisory
https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/int...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dayzsec
HaiND from the Post and Telecommunication Institute of Technology
.