{"id":"CVE-2026-110606","aliases":["DEBIAN-CVE-2026-110606","EUVD-2026-101234","GHSA-v4r9-37cv-99h9","UBUNTU-CVE-2026-110606","openSUSE-SU-2026:12156-1"],"status":"published","title":"LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00229,"percentile":0.13779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-10-14T14:16:46Z","modified":"2026-10-28T17:50:34Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"librecad","fixed_in":["2.2.1.5-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1","2.2.0.2-1","2.2.0.2-2","2.2.0.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0.2-1","2.2.0.2-2","2.2.0.2-3"]},{"source":"osv","ecosystem":"Debian:14","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0.2-1","2.2.0.2-2","2.2.0.2-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2","2.0.9-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-1","2.1.2-1ubuntu0.1~esm1","2.1.2-1ubuntu0.1~esm2","2.1.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1","2.1.3-1.2+deb10u1build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-1.3","2.1.3-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1","2.2.0.2-1","2.2.0.2-1build1","2.2.0.2-1build2","2.2.0.2-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0.2-1build3","2.2.0.2-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0.2-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1.5-2.1"}]}]}],"products":[{"vendor":"librecad","product":"libdxfrw"},{"vendor":"librecad","product":"librecad"}],"references":[{"url":"https://github.com/LibreCAD/LibreCAD/issues/2554","tags":["issue-tracking","exploit","report"]},{"url":"https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248","tags":["technical-description","article","report"]},{"url":"https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248","tags":["technical-description","article","report"]},{"url":"https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9","tags":["patch","fix","report"]},{"url":"https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b","tags":["patch","fix","report"]},{"url":"https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110606","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v4r9-37cv-99h9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110606.json","tags":["advisory"]},{"url":"https://github.com/LibreCAD/LibreCAD","tags":["package"]},{"url":"https://github.com/LibreCAD/libdxfrw","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110606","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-110606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110606","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110606","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110606","title":"LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T14:16:46.382Z","modified":"2026-10-20T01:07:40.851Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-101234","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T14:16:46Z","modified":"2026-10-20T01:07:40Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:44.89597Z"}],"ghsa":[{"id":"GHSA-v4r9-37cv-99h9","title":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds...","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T15:32:24Z","modified":"2026-10-14T15:32:31Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:26.117603Z"}],"nvd":[{"id":"CVE-2026-110606","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T15:17:12.303Z","modified":"2026-10-20T02:17:08.997Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"CVE-2026-110606","title":"LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T14:16:46.382Z","modified":"2026-10-28T02:31:14.416806747Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:55.61515Z"},{"id":"DEBIAN-CVE-2026-110606","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T15:17:12.303Z","modified":"2026-10-23T18:05:31.738346378Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110606","description":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","status":"published","published":"2026-10-14T15:17:00Z","modified":"2026-10-28T17:50:34Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"openSUSE-SU-2026:12156-1","title":"librecad-2.2.1.5-2.1 on GA media","description":"These are all security issues fixed in the librecad-2.2.1.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-17T10:00:04.121994877Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}