LibreDWG CVE-2026-54610

Exploitation requires an application that itself calls bit_TV_to_utf8() in src/bits.c and exposes it to untrusted input, AND passes src as an immutable buffer - a string literal, read-only mapping, shared immutable buffer, or other non-writable storage. It further requires that iconv() fail with an errno OTHER than E2BIG (for example a \U+XXXX escape sequence converted under CP_UTF16, as in the advisory reproducer), which routes execution to the bit_u_expand(osrc) in-place write. Limiting factors that reduce real-world risk: this is not reached through normal DWG decode/export because bit_read_TV() heap-allocates most TV strings (so the aliased buffer would be mutable, not read-only); the condition is therefore a non-default API-usage pattern rather than a default remote-reachable path, and impact is limited to a crash or unexpected mutation of caller-owned input.

All decision signals converge on low priority. The NVD CVSS is 3.3 (Low) with a local vector (AV:L), no privileges (PR:N) but required interaction (UI:R), and only an availability impact (A:L, with C:N/I:N); the vuln.today Decision label is 'monitor', which matches. There is no CISA KEV listing (so not confirmed actively exploited) and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. A public PoC reference exists - the GHSA advisory embeds a minimal reproducer that reliably triggers a SIGSEGV - but the input does not mark it as confirmed working exploit code, and crucially the reporter and advisory state that direct file-triggered exploitability through normal DWG decode/export paths is UNCONFIRMED because bit_read_TV() heap-allocates most TV strings. The signals are therefore consistent rather than conflicting: a genuine but conditional defect whose impact is capped at denial of service (or unexpected mutation of caller-owned input) and only when an application deliberately feeds untrusted data to bit_TV_to_utf8() with an immutable buffer. This is a real correctness/robustness bug but a low real-world priority, not a high-CVSS-but-overstated issue - the CVSS itself is already low and honest about the constraints.

An application that links LibreDWG and exposes bit_TV_to_utf8() to attacker-controlled strings passes a read-only buffer (e.g. a string literal or memory-mapped read-only data) containing a \U+XXXX escape with a codepage that makes iconv() fail with an errno other than E2BIG. On that error path the function calls bit_u_expand() on the aliased const input, writing in place and crashing the process (SIGSEGV), causing denial of service. A public PoC reproducer demonstrating the crash is included in the GHSA advisory; it is not verified as a weaponized exploit and file-driven triggering via normal DWG parsing is unconfirmed.