CVE-2026-110606 in LibreCAD
Summary
by MITRE • 10/14/2026
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within LibreCAD versions through 2.2.1.5, specifically affecting the libdxfrw component, represents a critical security flaw rooted in improper input validation during file parsing operations. This issue manifests as a stack-based out-of-bounds read, which occurs when the application attempts to process DWG files that adhere to older AutoCAD versions such as AC1018, AC1024, or AC1027. The core of the problem lies in the dwgReader18::readFileHeader() function, where the software fails to ensure that string buffers extracted from the decrypted file header are properly terminated with a null character before being passed to standard C library functions designed for string manipulation.
The technical mechanism behind this vulnerability involves the invocation of the strlen function on memory regions that do not contain an expected NUL terminator at their logical end. In C and C++ programming, strlen calculates the length of a string by scanning memory until it encounters a zero byte. When processing crafted DWG files where these header fields lack proper null termination, strlen continues reading beyond the allocated buffer boundaries into adjacent stack memory. This behavior constitutes an out-of-bounds read error, allowing the application to access sensitive data stored in nearby stack frames that were not intended for exposure during normal file parsing operations.
From a security classification perspective, this flaw aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads past the end of a buffer or array. The attack vector is classified under ATT&CK technique T1083, specifically related to File and Directory Discovery, as it involves parsing structured files that may contain maliciously crafted metadata. While primarily an information disclosure risk due to the nature of reading stack memory, such vulnerabilities can also lead to denial-of-service conditions if the read operation triggers a segmentation fault or access violation within the operating system's memory protection mechanisms.
The operational impact of this vulnerability is significant for users who rely on LibreCAD to open DWG files from untrusted sources. An attacker could craft a malicious DWG file containing specific header structures devoid of NUL bytes in critical fields. Upon opening such a file, the application would attempt to process these malformed inputs, leading to unpredictable behavior ranging from data leakage via stack inspection to immediate application crashes. This compromises both the confidentiality and availability aspects of the software's security posture, particularly in environments where users frequently exchange CAD drawings with external parties or download files from unverified repositories.
Mitigation strategies for this vulnerability involve updating LibreCAD to a patched version that addresses the root cause within libdxfrw. Developers must implement strict bounds checking before invoking strlen or similar string functions on data extracted from binary file formats. It is essential to verify buffer lengths against known limits defined by the DWG specification and ensure explicit null termination of all strings derived from external inputs. Additionally, users should exercise caution when opening CAD files obtained from untrusted sources until they have verified their software versions are up-to-date with the latest security patches released by the LibreCAD project team.