CVE-2026-111167 in LibreDWG
Summary
by MITRE • 10/15/2026
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in GNU LibreDWG versions through 0.14.8612 represents a critical memory safety flaw within the AcDs decoder component, specifically located in the acds_private function. This global out-of-bounds read issue stems from an insufficient validation of input data during the parsing process for DWG files, which are widely used CAD formats developed by Autodesk. The core technical failure involves the handling of schema property type indices when processing specific file structures such as schdat properties found in R2004 or R2010 and later versions of the format. When an attacker supplies a maliciously crafted DWG file containing an excessively large value for this property type index, the application fails to verify whether the index falls within the bounds of the associated static lookup table. Consequently, the decoder proceeds to access memory locations beyond the allocated buffer boundaries, leading to unauthorized data exposure or program termination.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-bounds Read vulnerabilities. The absence of rigorous boundary checks allows an attacker to force the application to read arbitrary memory contents based on the crafted input value. This behavior aligns with ATT&CK technique T1083, specifically related to File and Directory Discovery, as reading beyond buffer limits can potentially leak sensitive information stored in adjacent memory regions, although the primary immediate impact observed is often a denial of service through application crashes. The vulnerability affects multiple utilities within the LibreDWG ecosystem, including dwgread and dwg2dxf, meaning that any software integrating this library for DWG file processing is susceptible to exploitation if it does not implement additional input sanitization layers.
The operational impact of this vulnerability primarily manifests as a denial of service condition where applications utilizing GNU LibreDWG will crash or terminate unexpectedly upon encountering the malformed input. While out-of-bounds reads can sometimes lead to information disclosure, in this specific context involving static tables and decoder functions, the most consistent outcome is application instability. This disrupts workflows for engineers and designers who rely on these tools for viewing, converting, or analyzing CAD drawings. Furthermore, if an attacker can control subsequent execution flow based on leaked memory data, there may be potential risks for further exploitation, although the primary documented risk remains system stability and availability.
To mitigate this vulnerability, users should immediately upgrade to a patched version of GNU LibreDWG that addresses the boundary check deficiencies in the acds_private function. For organizations unable to update their software libraries promptly, implementing input validation at the application layer is recommended as an interim measure. This involves sanitizing incoming DWG files and rejecting any entries with schema property type indices that exceed expected maximum values for standard R2004 or R2010+ formats. Additionally, deploying sandboxing mechanisms can help contain potential crashes and prevent them from affecting broader system resources. Regular security audits of CAD processing pipelines should also be conducted to ensure compliance with secure coding standards regarding memory management and input validation.