OSV-2021-1086

Heap-buffer-overflow in dwg_convert_SAB_to_SAT1

No score

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728

Crash type: Heap-buffer-overflow READ 2
Crash state:
dwg_convert_SAB_to_SAT1
dxf_3dsolid
dwg_dxf_REGION_private

What each source reports

OSV No score

Heap-buffer-overflow in dwg_convert_SAB_to_SAT1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728

Crash type: Heap-buffer-overflow READ 2
Crash state:
dwg_convert_SAB_to_SAT1
dxf_3dsolid
dwg_dxf_REGION_private

Record: OSV-2021-1086
Updated: 2026-11-10

Affected packages

Affected packages
Package	Affected	Fixed
`libredwg` OSS-Fuzz	Listed versions, plus commit ranges 0.12.3.42640.12.3.42670.12.3.42700.12.3.42730.12.3.4280 Show 45 moreShow less 0.12.40.12.4.42880.12.4.42960.12.4.42980.12.4.43000.12.4.43020.12.4.43070.12.4.43130.12.4.43170.12.4.43210.12.4.43240.12.4.43310.12.4.43380.12.4.43430.12.4.43480.12.4.43620.12.4.43640.12.4.43670.12.4.42870.12.4.43680.12.4.43750.12.4.43780.12.4.43820.12.4.43840.12.4.43870.12.4.43900.12.4.43930.12.5-pre0.12.4.43950.12.4.43980.12.4.43990.12.4.44000.12.4.44020.12.50.12.4.44030.12.4.44040.12.4.44090.12.4.44150.12.4.44200.12.4.44230.12.4.44250.12.4.44300.12.4.44370.12.4.44420.12.4.4444	None known

History

History
Recorded	Changed	Sources
Nov 10, 2026	affected	OSV
Nov 9, 2026	affected	OSV
Nov 8, 2026	affected	OSV
Nov 7, 2026	affected	OSV
Nov 5, 2026	affected	OSV
Nov 4, 2026	affected, facts	OSV
Nov 3, 2026	affected	OSV
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

OSV-2021-1086 is a vulnerability with no CVSS score yet in libredwg, published August 2, 2021. No source lists public exploit code. No source names a fixed version.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728

This page doesn't list everything

Left out here: 842 versions. The JSON record has them.