Stack-Based Out-of-Bounds Read in LibreCAD libdxfrw

Executive Summary

CVE-2026-110606 is a stack-based out-of-bounds read in LibreCAD's libdxfrw library affecting DWG R2004+ file parsing. The issue occurs in the dwgReader18::readFileHeader function where a 108-byte encrypted header is decrypted into a fixed stack buffer without a guaranteed null terminator. The std::string constructor then calls strlen, which reads past the buffer's end into adjacent stack memory, causing crashes in sanitized builds. Attackers can exploit this by providing crafted DWG files with specific version IDs (AC1018, AC1024, AC1027) and no null bytes in the decrypted header.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing DWG files processed by LibreCAD's libdxfrw library. Use static analysis tools to check for out-of-bounds reads in the dwgReader18::readFileHeader function. Monitor crashes when opening DWG files with AC1018, AC1024, or AC1027 headers. Enable AddressSanitizer during compilation to detect stack buffer overflows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability primarily causes denial-of-service conditions by crashing the LibreCAD application when opening a maliciously crafted DWG file. In default builds, the impact is limited to crashes as the affected string is used only in debug logs. There is no demonstrated code execution or information disclosure in standard configurations. The vulnerability requires local access to exploit as it requires opening a specific file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing the application when processing maliciously crafted DWG files. It does not lead to code execution or information leaks in default builds, as the affected string is used only in debug logs. Therefore, it poses minimal direct risk to compliance with GDPR or HIPAA, which focus on data confidentiality, integrity, and availability. However, repeated crashes could disrupt system availability, indirectly affecting compliance if critical systems are impacted.

Useful 0 Not Useful 0

Mitigation Strategies

Update LibreCAD and libdxfrw to the latest patched versions. Avoid opening untrusted DWG files, especially those with AC1018, AC1024, or AC1027 headers. Implement file validation checks before processing. Monitor for crashes or unusual behavior when handling DWG files.

Useful 0 Not Useful 0