CVE-2026-126497 LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
A crafted DWG file opened in LibreCAD can trigger a heap overflow, crashing it or possibly executing code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-126497?
CVE-2026-126497 is a high-severity memory corruption vulnerability in LibreCAD, published on 11 Nov 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Weakness: CWE-787
Which versions are affected by CVE-2026-126497?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-126497?
No fix has been published for CVE-2026-126497 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-126497 being exploited?
There is no known exploitation of CVE-2026-126497 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-126497, GHSA-8vq5-h62f-ccwp, UBUNTU-CVE-2026-126497.