{"schema":"threatline.record/2","record":{"id":"CVE-2026-110606","aliases":[],"summary":"LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader","details":"LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.","categories":["Unclassified"],"product":"libdxfrw","vendor":"LibreCAD","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110606","source_modified_at":"2026-10-20T01:07:40.851Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"libdxfrw","vendor":"LibreCAD","versions":[{"version":"0","lessThanOrEqual":"LC2.2.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110606","source_modified_at":"2026-10-20T01:07:40.851Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"LibreCAD","vendor":"LibreCAD","versions":[{"version":"0","lessThanOrEqual":"2.2.1.5","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05708,"score_date":"2026-10-23"},"published_at":"2026-10-14T14:16:46.382Z","modified_at":"2026-10-20T01:07:40.851Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110606","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T01:07:40.851Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110606","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/LibreCAD/LibreCAD/issues/2554","tags":["exploit"]},{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9","tags":["patch"]},{"source":"CVE List","url":"https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T01:07:12.553697Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T01:07:40.851Z","content_hash":"96f3ac8cdd44ea3e49c88b84a167e0b700f3f59e15593d8c7f7d33813ad4b733"}}