CVE-2026-126497

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126497", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:45:21.807Z", "datePublished": "2026-11-11T00:58:50.339Z", "dateUpdated": "2026-11-12T19:15:47.896Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-11T00:58:50.339Z"}, "datePublic": "2026-11-08T00:00:00.000Z", "title": "LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage", "descriptions": [{"lang": "en", "value": "LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "LibreCAD", "product": "LibreCAD", "defaultStatus": "unaffected", "packageURL": "pkg:github/LibreCAD/LibreCAD", "repo": "https://github.com/LibreCAD/LibreCAD", "versions": [{"version": "0", "lessThanOrEqual": "2.2.1.6", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:librecad:librecad:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.2.1.6"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/LibreCAD/LibreCAD/issues/3256", "tags": ["issue-tracking"]}, {"url": "https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6", "tags": ["patch"]}, {"url": "https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173", "tags": ["technical-description"]}, {"url": "https://github.com/LibreCAD/LibreCAD", "tags": ["product"]}, {"name": "VulnCheck Advisory: LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"}], "credits": [{"lang": "en", "value": "Lee Keon-Hyeong", "type": "finder"}, {"lang": "en", "value": "Park-Jung-Hyun", "type": "finder"}, {"lang": "en", "value": "dxli", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T19:15:37.141006Z", "id": "CVE-2026-126497", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:15:47.896Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/LibreCAD/LibreCAD", "product": "LibreCAD", "repo": "https://github.com/LibreCAD/LibreCAD", "vendor": "LibreCAD", "versions": [{"lessThanOrEqual": "2.2.1.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution."}], "id": "CVE-2026-126497", "lastModified": "2026-11-12T20:18:31.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126497", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T19:15:37.141006Z", "version": "2.0.3"}}]}, "published": "2026-11-11T01:17:14.597", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/LibreCAD/LibreCAD"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/LibreCAD/LibreCAD/issues/3256"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "librecad: librecad: Arbitrary code execution via crafted DWG file", "id": "2571412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571412"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in LibreCAD. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted Drawing (DWG) file. Due to missing buffer size and offset validation in the bundled drawing parser library, opening the malicious file triggers an out-of-bounds write in heap memory, leading to an application crash or potential system compromise."], "mitigation": {"lang": "en:us", "value": "Avoid opening untrusted or unverified DWG files in LibreCAD. If LibreCAD is not required on the system, remove the optional package:\n```\ndnf remove librecad\n```\nRemoving this package removes 2D CAD functionality. Check dependency resolutions before proceeding to verify that no required desktop packages are removed."}, "name": "CVE-2026-126497", "public_date": "2026-11-11T00:58:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126497\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126497\nhttps://github.com/LibreCAD/LibreCAD\nhttps://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173\nhttps://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6\nhttps://github.com/LibreCAD/LibreCAD/issues/3256\nhttps://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"], "statement": "Red Hat has evaluated this vulnerability as an Important severity issue because successful exploitation allows arbitrary code execution or application crashes in the context of the running user. Although exploitation demands user interaction to open an untrusted drawing file, the potential compromise of the user's desktop environment elevates the risk above Moderate. LibreCAD is an optional client-side application that is not deployed or enabled by default in standard enterprise deployments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.2.1.6]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "LibreCAD", "source": "cna", "vendor": "LibreCAD"}, "product": "librecad", "vendor": "librecad"}], "created": "2026-11-12T00:45:21.958160+00:00", "updated": "2026-11-13T11:00:11.598449+00:00", "vendors": ["librecad", "librecad$PRODUCT$librecad"]}