CVE-2026-54610

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.

• CWE-471
• CWE-703

• https://github.com/LibreDWG/libredwg/commit/08c034a224a4e9512b1cd62e74b5cf081a4cfa89
• https://github.com/LibreDWG/libredwg/releases/tag/0.14
• https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq
• https://github.com/user-attachments/files/28631091/libredwg-bit-tv-to-utf8-submission.tar.gz
• https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq

Published

Oct 30, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54605OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols…7.2
• CVE-2026-54606SunEditor is a lightweight and powerful WYSIWYG editor in va…8.5
• CVE-2026-54607FastGPT is a knowledge-based AI application platform. Prior …7.7
• CVE-2026-54608MythicalDash is a Pterodactyl client area. In 3.5.4-aurora a…7.1
• CVE-2026-54609QTI Neon is a minimal, game-agnostic, relay-based UDP multip…8.6
• CVE-2026-5461The Forminator Forms plugin for WordPress is vulnerable to L…6.5
• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54612Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-54613Vvveb is a powerful and easy to use CMS with page builder to…5.4
• CVE-2026-54614DebugKit provides a debugging toolbar for CakePHP applicatio…4.3
• CVE-2026-54615Part-DB is an open source inventory management system for el…6
• CVE-2026-54616NanaZip is the 7-Zip derivative intended for the modern Wind…7.1