CVE-2026-126497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126497
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126497.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126497
Downstream
Published
2026-11-11T00:58:50Z
Modified
2026-11-12T07:07:29Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
Details

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126497.json"
}
References

Affected packages

Git / github.com/librecad/librecad

Affected ranges

Type
GIT
Repo
https://github.com/librecad/librecad
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.2.1.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.0.0beta5
2.*
2.0.0
2.0.0rc3
2.0.6
2.1.0-alpha
2.2.0
2.2.0-rc1
2.2.0-rc2
2.2.0-rc3
2.2.0-rc4
2.2.1.1_rc-latest
2.2.1.3_rc-latest
2.2.1_alpha
2.2.1_rc-latest
2.2.1_rc1
2.2.1_rc2
2.2.1_rc3
2.2.1_rc4
2.2.1_rc5
v2.*
v2.2.1
v2.2.1.1
v2.2.1.2
v2.2.1.3
v2.2.1.4
v2.2.1.5
v2.2.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126497.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57711104325656096133931813987753817324",
                "224498419676058664310058782093375689178",
                "163124418767796600104630243041712126733",
                "137672743045184749025274650614484913963",
                "298421868618964056285929733182517777906",
                "227058642776990234475421333492142876388",
                "130112479176533407579222391498249761820",
                "143810101388337650149989153265123537417",
                "324071449387132591500956233885004059704",
                "24609397587167158247568660766340978281",
                "34878106075166237632124980748750411467",
                "136843208324470596960115730087513173802",
                "145184171257301263588288969732369341137",
                "176542155671499675373360879713485848186",
                "27148459826526394798175976231945342074",
                "46622169076187652015822986891948191040",
                "320927777475477615773356875910414832408",
                "72814783722845158288785457581346705111",
                "111203916114318591935469399953585165107",
                "288416338513213689387062350212074723148",
                "157618874280450246810524743299067214687",
                "83551906811682080835047946582949747532",
                "120811272503365174873493329000597351685",
                "247044695252386965970271120249468384787",
                "141286306678475145787950648826474341546",
                "270589218648765819365979207450930126410",
                "168214290401769725275628394847414057813",
                "292145748990358377623942965897244841474",
                "81678769694175848255049213603828367635",
                "45563742601797067140782199017046938932",
                "228140002951892975608627354144130492407",
                "98396896205385996213221693194250853342",
                "240522512309630831697827857464120036961",
                "63023319149774050960125992398873200987",
                "277317681244296053422972486975906477098"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126497-56e7438c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/librecad/librecad/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6",
        "target": {
            "file": "libraries/libdxfrw/src/intern/dwgreader18.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "98333561116458653450486916990187600352",
            "length": 2834
        },
        "id": "CVE-2026-126497-7bf71672",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/librecad/librecad/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6",
        "target": {
            "file": "libraries/libdxfrw/src/intern/dwgreader18.cpp",
            "function": "dwgReader18::parseDataPage"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:07:29Z"