LibreCAD EUVD-2026-101234

Exploitation requires a victim to open an attacker-supplied DWG file of version AC1018, AC1024, or AC1027 in LibreCAD or software linking libdxfrw; the file's decrypted header must be specially constructed to contain no NUL byte so that strlen() in dwgReader18::readFileHeader() runs off the end of a stack buffer. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) and requires active user interaction (UI:P) - the malicious file must be delivered and manually opened - and the observed outcome is a process crash rather than code execution or confirmed data disclosure. No special non-default configuration is needed beyond opening an affected DWG version.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency, and the signals are largely consistent. The official CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 (MEDIUM) and tells a coherent story: exploitation is local and file-based, requires victim interaction (UI:P - opening a crafted file), and the only confirmed impact is availability (VA:L, a process crash). Critically, the vendor-assigned vector sets VC:N (no confidentiality impact) even though this is an out-of-bounds READ and is tagged 'Information Disclosure' - this is a notable tension: the strlen() over-read walks adjacent stack memory to compute a length rather than returning that memory to the attacker, so practical impact is a crash/DoS rather than reliable data exfiltration. No EPSS score, no KEV listing, and no explicit POC flag were provided in the input, so there is no evidence of active or automated exploitation; a detailed third-party technical write-up (hackmd) and a VulnCheck advisory exist, which lowers the research barrier but does not equal a weaponized exploit. There is no SSVC decision data in the input. Net: a real, patch-worthy memory-safety bug whose realistic worst case is crashing a desktop CAD application when a user opens a malicious drawing - prioritize normal patching, not emergency response.

An attacker crafts a malicious AC1018, AC1024, or AC1027 DWG file whose decrypted header contains no NUL bytes and distributes it via email, a shared drawing repository, or a download. When a victim opens the file in LibreCAD (or any application using libdxfrw), dwgReader18::readFileHeader() calls strlen() on the non-terminated buffer, reading past the end of the stack buffer and crashing the process. A public technical write-up describing the flaw exists, but the input provides no evidence of a weaponized public exploit or active exploitation.