High priorityDisclosed

Advisory · CVE-2026-126497

Crafted DWG file can crash LibreCAD and may allow code execution

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write in the bundled libdxfrw DWG reader that triggers when a crafted AC1018 file is opened.

Advisory published November 11, 2026Independent summary
Vendor
LibreCAD
Product
LibreCAD
Identifier / CWE
CVE-2026-126497
CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

LibreCAD reads DWG drawing files by copying chunks of data into a fixed space in memory. A booby-trapped file lies about the size of a chunk, so LibreCAD writes past the end of that space, which can crash the program or let the file's author run code.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted file

    An attacker builds an AC1018 (R2004) DWG file with malicious startOffset values in a data page.

  2. 02Victim opens it

    A user opens the file in LibreCAD, and the bundled libdxfrw reader starts parsing the data page.

  3. 03Unchecked offsets

    dwgReader18::parseDataPage() does not validate the buffer size and page offsets before decompressing.

  4. 04Heap overflow

    decompress18 writes past the heap buffer, crashing LibreCAD and potentially allowing code execution in the user's context.

What happened

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write in the bundled libdxfrw library. The dwgReader18::parseDataPage() function does not check buffer size and page offsets, so a crafted AC1018 (R2004) DWG file with malicious startOffset values makes decompress18 write past the heap buffer when the file is opened. The issue was reproduced in LibreCAD 2.2.0, 2.2.1.5, and 2.2.1.6.

A fix commit is referenced by NVD. No fixed release version was named at publication time.

What to do

  1. Do not open DWG files from untrusted sources until the installed LibreCAD includes the fix.
  2. Upgrade to a release containing the fix once one is published.
  3. Treat DWG files received by email, download, or file share as untrusted input, and open them in an isolated environment where possible.
  4. Run LibreCAD with least privilege so a successful exploit cannot reach more than the user’s own files.

Management note

This is a classic file-format bug: the risk lands on whoever opens a drawing from outside the organisation. The control is simple, do not open untrusted DWG files, but it only works if the people who handle drawings know about it.