CVE-2026-110606
Full vulnerability record from the local CVENow database.
Description
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-10-14 15:17:12.303000
Last modified
2026-10-20 02:17:08.997000
View original CVE JSON
{
"id": "CVE-2026-110606",
"sourceIdentifier": "[email protected]",
"published": "2026-10-14T15:17:12.303",
"lastModified": "2026-10-20T02:17:08.997",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "LibreCAD",
"product": "libdxfrw",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/LibreCAD/libdxfrw",
"repo": "https://github.com/LibreCAD/libdxfrw",
"packageURL": "pkg:github/LibreCAD/libdxfrw",
"versions": [
{
"version": "0",
"lessThanOrEqual": "LC2.2.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "LibreCAD",
"product": "LibreCAD",
"defaultStatus": "unaffected",
"repo": "https://github.com/LibreCAD/LibreCAD",
"packageURL": "pkg:github/LibreCAD/LibreCAD",
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.2.1.5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"baseScore": 3.3,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-20T01:07:12.553697Z",
"id": "CVE-2026-110606",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248",
"source": "[email protected]"
},
{
"url": "https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b",
"source": "[email protected]"
},
{
"url": "https://github.com/LibreCAD/LibreCAD/issues/2554",
"source": "[email protected]"
},
{
"url": "https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248",
"source": "[email protected]"
},
{
"url": "https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9",
"source": "[email protected]"
},
{
"url": "https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader",
"source": "[email protected]"
},
{
"url": "https://github.com/LibreCAD/LibreCAD/issues/2554",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}