low · CVSS v3 3.3 · EPSS 0.00118

CVE-2026-54610

LibreDWG's bit_TV_to_utf8() can write to caller-provided buffer, causing segmentation faults or unintended data modification. The flaw exist

Overview

LibreDWG's bit_TV_to_utf8() can write to caller-provided buffer, causing segmentation faults or unintended data modification. The flaw exists in versions before 0.14 and may lead to denial of service or data integrity issues when processing untrusted DWG files.

Description

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.

Impact

Availability: the library can crash, denying service. Integrity: attacker may alter data returned to the caller. Confidentiality: unlikely to leak data directly, but corrupted data could lead to misinterpretation. Impacted parties: any application that uses LibreDWG to read or write DWG files from untrusted sources, such as CAD viewers, converters, or web services.

Remediation

Upgrade LibreDWG to version 0.14 or later. If upgrade is not possible, validate that input buffers are writable and not read-only, enforce size limits, and consider running the library in a sandboxed environment. Monitor for crashes and apply patches promptly.

Risk context

The CVE has a low severity score (3.3) and a very low EPSS of 0.00118, indicating a low likelihood of exploitation in the wild. Nonetheless, the impact on availability warrants timely patching.

Affected products

  • LibreDWG

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.3
CVSS v4
—
EPSS
0.00118

libredwg denial-of-service buffer-overwrite untrusted-input segfault patch low-severity

← All CVEs

Related CVEs

low

CVE-2026-120310

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

View analysis

low

CVE-2026-117680

Improper check for unusual or exceptional conditions in the pattern and patternProperties keywords of the lud jsv library allows an unauthenticated remote attacker to bypass schema validation by exploiting backtracking budget exhaustion. This can lead to acceptance of malicious data that would otherwise be rejected. The vulnerability affects jsv versions 0.1.0 through 0.26.2.

View analysis

low

CVE-2026-117649

This CVE exposes metadata of private issues linked as dependencies to public issues, allowing anonymous or unauthenticated users to view titles, bodies, labels, and attachment names via the API and web page. The flaw occurs when a readable issue references a private issue, bypassing access controls on the linked issue's content. It matters because it leaks sensitive information about private repositories to anyone who can view the public issue.

View analysis

low

CVE-2026-120223

A low‑severity flaw in Oray Pugongying X5 Pro (v≤7.6.1) allows remote attackers to manipulate the _user argument in session_get, producing insufficiently random session IDs. This can lead to session prediction or hijacking. The vulnerability is publicly documented but the vendor has not released a fix.

View analysis