Bug 2571412 (CVE-2026-126497)

Summary: CVE-2026-126497 librecad: librecad: Arbitrary code execution via crafted DWG file
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in LibreCAD. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted Drawing (DWG) file. Due to missing buffer size and offset validation in the bundled drawing parser library, opening the malicious file triggers an out-of-bounds write in heap memory, leading to an application crash or potential system compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2571706    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-11 01:11:28 UTC 
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.