{"id":"CVE-2026-111167","summary":"GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder","details":"GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.","modified":"2026-10-21T02:50:18.421810237Z","published":"2026-10-15T18:57:53.338Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111167.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111167.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111167"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gnu-libredwg-through-0.14.8612-out-of-bounds-read-in-acds-private-acds-decoder"},{"type":"PACKAGE","url":"https://github.com/LibreDWG/libredwg"},{"type":"ARTICLE","url":"https://github.com/LibreDWG/libredwg/blob/d9468ae948b8f07a08efa756c19f8916052358c0/src/acds.spec#L250-L260"},{"type":"ARTICLE","url":"https://hackmd.io/@haind-pwn/libredwg-acds-schema-prop-type-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libredwg/libredwg","events":[{"introduced":"0"},{"last_affected":"f860b0fb76d5f8effb5a70769a3389cb1e0308c8"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"0.14.8612"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"0.14.8612"}]}]}}],"versions":["0.14.8612","0.14.8608","0.14.8607","0.14.8601","0.14.8600","0.14.8599","0.14.8597","0.14.8594","0.14.8593","0.14.8592","0.14.8590","0.14.8585","0.14.8584","0.14.8583","0.14.8580","0.14.8578","0.14.8566","0.14.8561","0.14.8556","0.14.8554","0.14.8553","0.14.8547","0.14.8531","0.14.8522","0.14.8492","0.14.8488","0.14.8487","0.14.8471","0.14.8465","0.14.8464","0.14.8460","0.14.8447","0.14.8433","0.14.8421","0.14.8418","0.14.8415","0.14.8413","0.14.8411","0.14.8406","0.14.8403","0.14.8396","0.14.8394","0.14.8390","0.14.8384","0.14.8374","0.14.8367","0.14.8363","0.14","0.13.4.8360","0.13.4.8356","0.13.4.8351","0.13.4.8348","0.13.4.8343","0.13.4.8336","0.13.4.8321","0.13.4.8317","0.13.4.8313","0.13.4.8304","0.13.4.8302","0.13.4.8295","0.13.4.8294","0.13.4.8293","0.13.4.8285","0.13.4.8284","0.13.4.8278","0.13.4.8273","0.13.4.8270","0.13.4.8268","0.13.4.8263","0.13.4.8252","0.13.4.8249","0.13.4.8246","0.13.4.8241","0.13.4.8237","0.13.4.8236","0.13.4.8234","0.13.4.8231","0.13.4.8230","0.13.4.8229","0.13.4.8216","0.13.4.8214","0.13.4.8200","0.13.4.8198","0.13.4.8187","0.13.4.8178","0.13.4.8174","0.13.4.8171","0.13.4.8169","0.13.4.8168","0.13.4.8166","0.13.4.8163","0.13.4.8160","0.13.4.8149","0.13.4.8144","0.13.4.8140","0.13.4.8131","0.13.4.8129","0.13.4.8123","0.13.4.8118","0.13.4.8115","0.13.4.8112","0.13.4.8104","0.13.4.8091","0.13.4.8085","0.13.4.8055","0.13.4.8051","0.13.4.8043","0.13.4.8036","0.13.4.8028","0.13.4.8018","0.13.4.8014","0.13.4.8001","0.13.4.7998","0.13.4.7985","0.13.4.7976","0.13.4.7974","0.13.4.7969","0.13.4","0.13.3.7918","0.13.3.7913","0.13.3.7906","0.13.3.7901","0.13.3.7897","0.13.3.7883","0.13.3.7873","0.13.3.7867","0.13.3.7861","0.13.3.7852","0.13.3.7851","0.13.3.7850","0.13.3.7849","0.13.3.7848","0.13.3.7846","0.13.3.7842","0.13.3.7835","0.13.3.7828","0.13.3.7825","0.13.3.7819","0.13.3.7816","0.13.3.7813","0.13.3.7812","0.13.3.7810","0.13.3.7808","0.13.3.7805","0.13.3.7802","0.13.3.7797","0.13.3.7794","0.13.3.7792","0.13.3.7789","0.13.3.7778","0.13.3.7776","0.13.3.7772","0.13.3.7763","0.13.3.7761","0.13.3.7752","0.13.3.7743","0.13.3.7741","0.13.3.7737","0.13.3.7730","0.13.3.7727","0.13.3.7721","0.13.3.7715","0.13.3.7702","0.13.3.7696","0.13.3.7690","0.13.3.7686","0.13.3.7685","0.13.3.7680","0.13.3.7675","0.13.3.7665","0.13.3.7663","0.13.3.7657","0.13.3.7650","0.13.3.7649","0.13.3.7646","0.13.3.7640","0.13.3.7637","0.13.3.7635","0.13.3.7603","0.13.3.7600","0.13.3.7599","0.13.3.7582","0.13.3.7577","0.13.3.7574","0.13.3.7571","0.13.3.7562","0.13.3.7558","0.13.3.7557","0.13.3.7554","0.13.3.7552","0.13.3.7551","0.13.3.7545","0.13.3.7539","0.13.3.7535","0.13.3.7534","0.13.3.7533","0.13.3.7516","0.13.3.7507","0.13.3.7501","0.13.3.7491","0.13.3.7483","0.13.3.7473","0.13.3.7472","0.13.3.7469","0.13.3.7466","0.13.3.7460","0.13.3.7456","0.13.3.7453","0.13.3.7445","0.13.3.7442","0.13.3.7437","0.13.3.7434","0.13.3.7431","0.13.3.7429","0.13.3.7426","0.13.3.7424","0.13.3.7420","0.13.3.7414","0.13.3.7412","0.13.3.7411","0.13.3.7409","0.13.3.7405","0.13.3.7385","0.13.3.7377","0.13.3.7371","0.13.3.7351","0.13.3.7345","0.13.3.7344","0.13.3.7341","0.13.3.7338","0.13.3.7327","0.13.3.7324","0.13.3.7320","0.13.3.7308","0.13.3.7306","0.13.3.7298","0.13.3.7273","0.13.3.7270","0.13.3.7268","0.13.3.7265","0.13.3.7264","0.13.3.7262","0.13.3.7259","0.13.3.7257","0.13.3.7251","0.13.3.7246","0.13.3.7240","0.13.3.7233","0.13.3.7227","0.13.3.7226","0.13.3.7225","0.13.3.7224","0.13.3.7223","0.13.3.7220","0.13.3.7217","0.13.3.7199","0.13.3.7190","0.13.3.7187","0.13.3.7186","0.13.3.7183","0.13.3.7176","0.13.3.7168","0.13.3.7166","0.13.3.7165","0.13.3.7163","0.13.3","0.13.2","0.13.1","0.13","0.12.5","0.12.4","0.12.3","0.12.2","0.12.1","0.12","0.11.1","0.11","0.10.1","0.10","0.9.3","0.9.2","0.9.1","0.9","0.8","0.7","0.6.2","0.6.1","0.6","0.5","0.4.938","0.4.924","0.4.900","0.4-dev","0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111167.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}