CVE-2026-110606: Out-of-bounds Read in LibreCAD libdxfrw

LibreCAD's libdxfrw through version 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in the dwgReader18::readFileHeader() function. This occurs because the function calls strlen on buffers that may not be NUL-terminated when processing certain DWG file formats (AC1018, AC1024, AC1027). An attacker can supply a specially crafted DWG file with a decrypted header lacking NUL bytes, causing the function to read beyond the intended buffer boundary, leading to adjacent stack memory disclosure and application crash.

The vulnerability allows an attacker to cause a process crash (denial of service) by supplying a malicious DWG file. There is also potential for reading adjacent stack memory, which could lead to information disclosure. However, there is no indication of privilege escalation or remote code execution. The CVSS score of 4.8 reflects a medium severity impact with local attack vector and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted DWG files with vulnerable versions of LibreCAD. Monitor official LibreCAD channels for updates and patches addressing this issue.