Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54610— LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

Quick assessment

Affected
LibreDWG libredwg
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreDWG 是一个用于读写 DWG 文件的免费 C 语言库。在 0.14 版本之前， 中的 函数尽管接收 类型的输入参数，仍可能向调用者提供的 缓冲区写入数据。当 发生除 之外的错误时，该函数会释放其输出缓冲区，并将原始输入别名传递给 。 会就地扩展或收缩 Unicode 及多字节转义序列。如果输入是字符串字面量、只读内存映射或其他不可变缓冲区，这种写操作可能导致段错误（segmentation fault）并引发拒绝服务（DoS）；若输入为调用者可变的缓冲区，则可能在返回前被意外修改。此问题会影响那些在特定

CVSS 3.3 · Low

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54610

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling
Source: CVE Program / CVE List V5
Vulnerability Description
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变数据的修改(MAID)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LibreDWG libredwg < 0.14 -

II. Public POCs for CVE-2026-54610

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54610

请登录查看更多情报信息。

Vendor Pages for CVE-2026-54610 (1)

Other References for CVE-2026-54610 (3)

Same Patch Batch · LibreDWG · 2026-10-30 · 3 CVEs total

CVE-2026-62254 5.5 MEDIUM LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
CVE-2026-62250 5.5 MEDIUM LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

IV. Related Vulnerabilities

Same product: libredwg
Same vendor: LibreDWG
Same weakness: CWE-471