Every CVE Search/ Get API key

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

4.8 MediumFix available

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.23%Up 0.1 points since Oct 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
CVE-2026-110606
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-101234 4.8

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
EUVD-2026-101234
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v4r9-37cv-99h9 4.8

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds...

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
GHSA-v4r9-37cv-99h9
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 4.8

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
CVE-2026-110606
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
OSV 4.8

LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
CVE-2026-110606
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-110606 4.8

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
DEBIAN-CVE-2026-110606
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-110606 4.8

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

Record
UBUNTU-CVE-2026-110606
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:12156-1 No score

librecad-2.2.1.5-2.1 on GA media

These are all security issues fixed in the librecad-2.2.1.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12156-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
librecad
Debian:12
 All versions, plus listed versions
2.2.0-12.2.0.2-12.2.0.2-22.2.0.2-3
 None known
librecad
Debian:13
 All versions, plus listed versions
2.2.0.2-12.2.0.2-22.2.0.2-3
 None known
librecad
Debian:14
 All versions, plus listed versions
2.2.0.2-12.2.0.2-22.2.0.2-3
 None known
librecad
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.0.4-1build12.0.8-12.0.9-22.0.9-2ubuntu0.1~esm1
 None known
librecad
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.1.2-12.1.2-1ubuntu0.1~esm12.1.2-1ubuntu0.1~esm22.1.2-1ubuntu0.1
 None known
librecad
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1.3-1.22.1.3-1.2build12.1.3-1.2+deb10u1build0.20.04.1
 None known
librecad
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.1.3-1.32.1.3-3
 None known
librecad
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.0-12.2.0.2-12.2.0.2-1build12.2.0.2-1build22.2.0.2-1build3
 None known
librecad
Ubuntu:26.10
 All versions, plus listed versions
2.2.0.2-1build32.2.0.2-3
 None known
librecad
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.0.2-1build3
 None known
librecad
openSUSE:Tumbleweed
 before 2.2.1.5-2.1
2.2.1.5-2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-110606 is a medium vulnerability (CVSS 4.8) in Librecad Libdxfrw, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in librecad 2.2.1.5-2.1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open