CVE-2026-111167

Deferred Deferred - Pending Action

Global Out-of-Bounds Read in GNU LibreDWG

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111167

EUVD

EUVD-2026-102294

Affected Vendors & Products

Vendor	Product	Version / Range
GNU	LibreDWG	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

GNU LibreDWG through 0.14.8612 has an out-of-bounds read flaw in the AcDs decoder function acds_private(). When processing DWG files with a large 'schdat' property type value, the application reads beyond a static 16-byte table without checking bounds. This occurs in R2004 or R2010+ DWG files and can crash tools like dwgread or dwg2dxf.

Detection Guidance

Detecting this vulnerability requires analyzing DWG files for malformed 'schdat' property type values. Use LibreDWG tools like dwgread or dwg2dxf on suspicious files to check for crashes or errors. Monitor application logs for segmentation faults when processing DWG files.

Impact Analysis

This vulnerability allows attackers to crash applications parsing untrusted DWG files, leading to denial-of-service. If exploited, it could cause tools like dwgread or dwg2dxf to fail, potentially disrupting workflows that rely on LibreDWG for DWG file processing.

Compliance Impact

This vulnerability primarily causes application crashes via denial-of-service when parsing malformed DWG files. It does not directly expose or leak sensitive data, which is a key requirement for GDPR or HIPAA compliance. However, repeated crashes in systems handling DWG files could disrupt operations, potentially impacting availability of services that process CAD drawings containing personal or health information.

Mitigation Strategies

Update LibreDWG to the latest patched version if available. Avoid opening untrusted DWG files, especially R2010+ versions. Implement file validation before processing with LibreDWG tools. Consider using alternative libraries for DWG parsing until a fix is confirmed.

Hi! I’m here to help you understand CVE-2026-111167. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70