{"id":"CVE-2026-126497","summary":"LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage","details":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.","modified":"2026-11-12T07:07:29.619179698Z","published":"2026-11-11T00:58:50.339Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126497.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126497.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126497"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"},{"type":"REPORT","url":"https://github.com/LibreCAD/LibreCAD/issues/3256"},{"type":"FIX","url":"https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"},{"type":"PACKAGE","url":"https://github.com/LibreCAD/LibreCAD"},{"type":"ARTICLE","url":"https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/librecad/librecad","events":[{"introduced":"0"},{"fixed":"17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"2.2.1.6"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"}]}]}}],"versions":["v2.2.1.6","v2.2.1.5","v2.2.1.4","2.2.1.3_rc-latest","v2.2.1.3","2.2.1.1_rc-latest","v2.2.1.2","v2.2.1.1","2.2.1_rc-latest","v2.2.1","2.2.1_rc5","2.2.1_rc4","2.2.1_rc3","2.2.1_rc2","2.2.1_rc1","2.2.0","2.2.1_alpha","2.2.0-rc4","2.2.0-rc3","2.2.0-rc2","2.2.0-rc1","2.1.0-alpha","2.0.6","2.0.0","2.0.0rc3","1.0.0beta5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126497.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/librecad/librecad/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6","target":{"file":"libraries/libdxfrw/src/intern/dwgreader18.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["57711104325656096133931813987753817324","224498419676058664310058782093375689178","163124418767796600104630243041712126733","137672743045184749025274650614484913963","298421868618964056285929733182517777906","227058642776990234475421333492142876388","130112479176533407579222391498249761820","143810101388337650149989153265123537417","324071449387132591500956233885004059704","24609397587167158247568660766340978281","34878106075166237632124980748750411467","136843208324470596960115730087513173802","145184171257301263588288969732369341137","176542155671499675373360879713485848186","27148459826526394798175976231945342074","46622169076187652015822986891948191040","320927777475477615773356875910414832408","72814783722845158288785457581346705111","111203916114318591935469399953585165107","288416338513213689387062350212074723148","157618874280450246810524743299067214687","83551906811682080835047946582949747532","120811272503365174873493329000597351685","247044695252386965970271120249468384787","141286306678475145787950648826474341546","270589218648765819365979207450930126410","168214290401769725275628394847414057813","292145748990358377623942965897244841474","81678769694175848255049213603828367635","45563742601797067140782199017046938932","228140002951892975608627354144130492407","98396896205385996213221693194250853342","240522512309630831697827857464120036961","63023319149774050960125992398873200987","277317681244296053422972486975906477098"]},"id":"CVE-2026-126497-56e7438c"},{"target":{"file":"libraries/libdxfrw/src/intern/dwgreader18.cpp","function":"dwgReader18::parseDataPage"},"deprecated":false,"digest":{"length":2834,"function_hash":"98333561116458653450486916990187600352"},"id":"CVE-2026-126497-7bf71672","signature_type":"Function","signature_version":"v1","source":"https://github.com/librecad/librecad/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"}],"vanir_signatures_modified":"2026-11-12T07:07:29Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}