LibreCAD: Heap-based out-of-bounds write in libdxfrw (CVE-2026-126497)
LibreCAD versions through 2.2.1.6 contain a heap-based out-of-bounds write vulnerability in the libdxfrw library that could allow for application crashes or arbitrary code execution via a crafted DWG file.
CVE search metadata
CVE search record: CVE-2026-126497. Severity: high. CVSS: 7.8. KEV: no. Product: LibreCAD (<= 2.2.1.6). Brief: LibreCAD: Heap-based out-of-bounds write in libdxfrw (CVE-2026-126497). Brief link: https://feed.craftedsignal.io/briefs/2026-11-librecad-heap-overflow/
Triage facts
Revision 1- Applicability
- LibreCAD (<= 2.2.1.6)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 05:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
LibreCAD versions through 2.2.1.6 are susceptible to a heap-based out-of-bounds write vulnerability located in the dwgReader18::parseDataPage() function of the bundled libdxfrw library. The vulnerability is caused by a failure to perform adequate boundary checks on buffer sizes and page offsets. An attacker can exploit this by providing a specially crafted AC1018 (R2004) DWG file containing malicious startOffset values, which triggers an out-of-bounds write in the decompress18 function when the file is parsed by LibreCAD.
Impact
Successful exploitation may result in an application crash (denial of service) or potential arbitrary code execution within the context of the user running LibreCAD.
Recommendation
- Inventory all systems where LibreCAD is installed and identify the current version.
- Advise users to avoid opening untrusted or unsolicited DWG files until a security update is released and applied.
- Implement endpoint monitoring for anomalous LibreCAD process behavior or crash activity.
Immediate actions
Inventory LibreCAD instances across the organization.
Threat Hunt
Identify crashes of LibreCAD.exe or libre-cad process linked to DWG file handling.
Data: Windows Event Logs (Application Error), Linux system logs, or EDR process monitoring.
Mitigations
Advise end users to refrain from opening files from unknown sources using LibreCAD until an update is provided by the vendor.
CVE-2026-126497