Buffer overflow in Librecad
CVE-2026-126497
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.002, 6.6th percentile (scored ). About EPSS.
Affected products
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- zeetee1235/CVE-2026-126497 (last pushed 2026-11-12)
References
- github.com/LibreCAD/LibreCAD (product)
- github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgrea… (technical-description)
- github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6 (patch)
- github.com/LibreCAD/LibreCAD/issues/3256 (issue-tracking)
- www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-… (third-party-advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.