HIGHCVSS v3.1 7.8Vulnerability
CVE-2026-126497
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Epss score
- 0.00171
- Cvss severity
- HIGH
- Cvss score
- 7.8
- Retrieved at
- 2026-11-11T23:51:13+00:00
- Last source
- FIRST EPSS
- Score
- 7.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-126497
- Cvss vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-11T03:34:07+00:00
- Name
- CVE-2026-126497
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-11-11T01:17:14.597
- Last modified
- 2026-11-11T01:17:14.740
- Epss percentile
- 0.06581
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph