{"id":"EM-20261111-WSBZ","url":"https://cyber.eventmonitor.net/incident/EM-20261111-WSBZ/librecad-vulnerability-cve-2026-126497/","type":"cve","title":"LibreCAD Vulnerability (CVE-2026-126497)","subtitle":"CVE-2026-126497","subject":"CVE-2026-126497","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-11T01:17:14.597Z","firstSignal":"2026-11-11T00:58:50.000Z","lastSignal":"2026-11-11T01:17:14.597Z","updated":"2026-11-12T00:31:06.720Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T01:17:14.597Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-11T01:17:14.597Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T00:58:50.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-11T01:17:14.597Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261111-WSBZ created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T01:17:14.597Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T01:17:14.597Z","detail":"CVSS 8.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-11T00:58:50.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T00:58:50.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-126497 (important)","text":"librecad: librecad: Arbitrary code execution via crafted DWG file","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126497.json"},{"at":"2026-11-11T01:17:14.597Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-126497 (CVSS 8.5)","text":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126497"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T01:17:14.597","score":8.5,"severity":"HIGH","desc":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to…","product":"","seen":1794369485031},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}