{"id":"CVE-2021-21899","aliases":["DEBIAN-CVE-2021-21899","DLA-2838-1","DSA-5077-1","EUVD-2021-9070","GHSA-xwm9-c4jc-crcp","MGASA-2022-0151","UBUNTU-CVE-2021-21899","USN-5957-1","openSUSE-SU-2022:0067-1","openSUSE-SU-2024:11697-1"],"status":"published","title":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of...","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02762,"percentile":0.86396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2021-11-19T00:00:00Z","modified":"2026-10-23T18:03:24Z","fixes":[{"ecosystem":"Debian:12","package":"librecad","fixed_in":["2.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librecad","fixed_in":["2.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librecad","fixed_in":["2.1.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","fixed_in":["2.0.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"librecad","fixed_in":["2.1.3-1.2+deb10u1build0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb9u2"}]}],"versions":["2.1.2-1","2.1.2-1+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1"}]}],"versions":["2.1.3-1.2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.3+deb11u1"}]}],"versions":["2.1.3-1.3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git.20220109-bp153.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp153.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git.20220109-bp153.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp153.2.3.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"librecad","product":"libdxfrw"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2021-1350","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDI3HCTCACMIC7I4ILB3NRU6DCMADI5H/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTIAMP7QJDKV4ADDLR4GVVX2TXYLHVOZ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5077","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202305-26","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21899"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDI3HCTCACMIC7I4ILB3NRU6DCMADI5H/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTIAMP7QJDKV4ADDLR4GVVX2TXYLHVOZ/"},{"url":"https://github.com/advisories/GHSA-xwm9-c4jc-crcp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21899","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0151.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29720","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RDI3HCTCACMIC7I4ILB3NRU6DCMADI5H/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2838","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6TWLTKRSHNPCLQL7UXQSITHNYJT5XSK5/","tags":["web","advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21899","tags":["report"]},{"url":"https://github.com/LibreCAD/libdxfrw/commit/6417118874333309aa10c4e59f954c3905a6e8b5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5957-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45343","tags":["report"]},{"url":"https://bugzilla.suse.com/1192936","tags":["report"]},{"url":"https://bugzilla.suse.com/1192937","tags":["report"]},{"url":"https://bugzilla.suse.com/1192938","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21900","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-21899","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T00:00:00Z","modified":"2024-08-03T18:30:22.887Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-9070","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T00:00:00Z","modified":"2024-08-03T18:30:22Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:04.094929Z"}],"ghsa":[{"id":"GHSA-xwm9-c4jc-crcp","title":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of...","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2022-05-24T19:21:07Z","modified":"2023-05-30T05:00:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:54:37.218716Z"}],"nvd":[{"id":"CVE-2021-21899","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T19:15:08.08Z","modified":"2026-06-17T03:36:19.5Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:07:01.428028Z"}],"osv":[{"id":"CVE-2021-21899","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T19:15:08.08Z","modified":"2026-04-16T04:33:48.900335811Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-21899","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T19:15:08.08Z","modified":"2026-10-23T18:03:24.833551775Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-21899","description":"A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-11-19T19:15:00Z","modified":"2026-02-04T02:31:29.86991Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DLA-2838-1","title":"librecad - security update","status":"published","published":"2021-12-03T00:00:00Z","modified":"2026-03-09T01:19:10.853348Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5077-1","title":"librecad - security update","status":"published","published":"2022-02-15T00:00:00Z","modified":"2026-03-09T02:11:27.838044Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0151","title":"Updated libdxfrw packages fix security vulnerability","description":"A code execution vulnerability exists in the dwgCompressor::decompress18()\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dwg file can lead to an out-of-bounds write. An attacker can provide a \nmalicious file to trigger this vulnerability. (CVE-2021-21898)\n\nA code execution vulnerability exists in the dwgCompressor::copyCompBytes21\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dwg file can lead to a heap buffer overflow. An attacker can provide a\nmalicious file to trigger this vulnerability. (CVE-2021-21899)\n\nA code execution vulnerability exists in the dxfRW::processLType()\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dxf file can lead to a use-after-free vulnerability. An attacker can provide\na malicious file to trigger this vulnerability. (CVE-2021-21900)\n\nIn LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw\nallows an attacker to crash the application using a crafted DXF document.\n(CVE-2021-45343)\n","status":"published","published":"2022-04-24T10:43:54Z","modified":"2026-04-16T04:44:29.301389194Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0067-1","title":"Security update for libdxfrw, librecad","description":"This update for libdxfrw, librecad fixes the following issues:\n\n- Update to version 1.0.1+git.20220109:\n\n  * fixed ambiguous error for DRW_Dimension::parseDwg()\n  * fixed enless while()-loop for pre 2004 versions\n  * dwgReader::readDwgObjects() stop reading after 1st error\n  * dwgReader::readDwgEntities() stop reading after 1st error\n  * replace ENTRY_PARSE macro with template method\n  * remove unused DRW_Class::parseCode() method\n  * protect vector\u003c\u003e.reserve() calls\n  * Added NULL check for hatch code 93\n  * Fix bounds check in DRW_LWPolyline\n  * fix, check maxClassNum for valid value\n  * fixed wrong 2010+ check for 64-bit size\n  * Set compiler warnings on by default, because makes harder for bugs to go undetected. \tmodified:   CMakeLists.txt\n  * Fixed fall through and other warnings (#54)\n  * fix 'Vertex ID' printout\n\n- Update to version 1.0.1+git.20211110:\n\n  * fixed heap use after free vulnerability CVE-2021-21900 (boo#1192938)\n  * minor improvements to dwg2dxf, formatting and message output on success\n  * fixed heap buffer overflow vulnerability CVE-2021-21899 (boo#1192937)\n  * dwg2dxf - enable debug output of libdxfrw by command line switch\n  * fixed out-of-bounds write vulnerability CVE-2021-21898 (boo#1192936)\n  * fixed please note section formatting\n  * updated README.md for LibreCAD_3 branch and sf.net successor\n  * fixed LibreCAD 2 issue #1371, read failed with binary DXF\n  * Use ununordered_map instead of map\n  * manual merge changes from LibreCAD2\n  * and much more\n\n- Update to version 1.0.1+git.20200429:\n\n  * Fix includes install dir\n  * Export target as libdxfrw::libdxfrw to keep consistency with Conan packages\n  * Add archive destination in install\n  * Install DXFRW::dxfrw target\n  * Remove duplicate target properties\n  * Remove version from pkg-config file\n  * Let CMake handle C++11 compiler definition\n  * Change minimal required CMake version to 3.0\n  * cmake: add doc target\n  * README.md: fix typo\n  * cmake: generate and install pkgconfig\n  * cmake: add one for dwg2dxf\n  * cmake: set library VERSIONs\n  * cmake: use GNUInstallDirs\n\n- Update to version 0.6.3+git.20190501:\n\n  * Add build status and update example link\n  * Add Travis-CI script\n  * [#10] Fix compilation on GCC\n  * Fix bugs with .dwg import of TEXT and MTEXT entities\n  * This was unnecessary\n  * Link libdxfrw against libstdc++\n  * Return an error when the file ends prematurely\n  * Add version getter\n  * Fix polyline 2d/3d write\n  * Initialize return buffers in GetRawChar8 et al.\n\n- update to 2.2.0-rc3\n\n  * major release\n  * DWG imports are more reliable now\n  * and a lot more of bugfixes and improvements\n","status":"published","published":"2022-03-02T21:21:30Z","modified":"2026-02-04T03:12:47.135916Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11697-1","title":"libdxfrw-devel-1.0.1+git.20211110-1.1 on GA media","description":"These are all security issues fixed in the libdxfrw-devel-1.0.1+git.20211110-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:29.439357Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5957-1","title":"librecad vulnerabilities","description":"Cody Sixteen discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. This issue only affected\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DWG files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21898, CVE-2021-21899)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DRW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21900)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing JWW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-45341, CVE-2021-45342)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. (CVE-2021-45343)\n","status":"published","published":"2023-03-15T16:20:03Z","modified":"2026-06-25T13:31:54.198205802Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}