CVE-2026-54610
Received Received - Intake

Heap-based Buffer Overflow in LibreDWG Library

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-54610
EUVD
EUVD-2026-114464

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LibreDWG libredwg < 0.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CWE-471 The product does not properly protect an assumed-immutable element from being modified by an attacker.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in LibreDWG before version 0.14. The function bit_TV_to_utf8() incorrectly writes to a caller-provided buffer marked as const input. When an iconv() error occurs, it may free the output buffer and pass the original input to bit_u_expand(), which modifies the buffer in place. This can cause crashes or unexpected data changes if the input is immutable.

Detection Guidance

Detection requires checking if your system uses LibreDWG versions prior to 0.14. Inspect installed versions with commands like 'pkg-config --modversion libredwg' or 'ldconfig -p | grep libredwg'. If vulnerable, update to version 0.14 or later.

Impact Analysis

If you use LibreDWG in an application that exposes its conversion API to untrusted input, this flaw could lead to crashes or data corruption. Mutable buffers could be modified unexpectedly, while immutable buffers might cause segmentation faults. Direct exploitation via normal DWG file operations is unlikely.

Mitigation Strategies

Immediately update LibreDWG to version 0.14 or later. If updating is not possible, restrict access to applications using LibreDWG to trusted inputs only. Monitor for crashes or unexpected behavior in applications handling DWG files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart