CVE-2026-110606

EUVD-2026-101234
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
3.3 LOW
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
librecadlibdxfrw
𝑥
≤ 2.2.1.5
CNA
Common Weakness Enumeration
References
https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248
https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b
https://github.com/LibreCAD/LibreCAD/issues/2554
https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248
https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9
https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read
https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader