LibreDWG up to 0.13 UTF-8 Conversion src/bits.c bit_TV_to_utf8 memory corruption

Summaryinfo

A vulnerability, which was classified as problematic, was found in LibreDWG up to 0.13. This vulnerability affects the function bit_TV_to_utf8 of the file src/bits.c of the component UTF-8 Conversion. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-54610. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in LibreDWG up to 0.13. Affected by this issue is the function bit_TV_to_utf8 of the file src/bits.c of the component UTF-8 Conversion. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. CVE summarizes:

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-54610 since 06/15/2026. The exploitation is known to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 0.14 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Image Processing Software

Name

• LibreDWG

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13

Website

• Product: https://github.com/LibreDWG/libredwg/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion