Const input modified and crash in LibreDWG bit_TV_to_utf8
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
LibreDWG before 0.14 is affected. The bit_TV_to_utf8 function in src/bits.c writes to its const input after an iconv error other than E2BIG, which exposes a modification of assumed-immutable data (CWE-471). Applications that expose this API to untrusted input can crash when the input is an immutable buffer such as a string literal. Direct exploitation through normal DWG file decoding remains unconfirmed.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade LibreDWG to version 0.14, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA libredwg (LibreDWG) Fixed in 0.14
Timeline
- 2026-10-30 Threatist record created from CVE-2026-54610
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq
- https://github.com/LibreDWG/libredwg/commit/08c034a224a4e9512b1cd62e74b5cf081a4cfa89
- https://github.com/LibreDWG/libredwg/releases/tag/0.14
- https://github.com/user-attachments/files/28631091/libredwg-bit-tv-to-utf8-submission.tar.gz
More LibreDWG vulnerabilities
- TI-2026-83401 Unbounded allocation in LibreDWG pre-R13 DWG entity decoding CVSS 3.1MEDIUM 5.5
- TI-2026-83387 Excessive memory reallocation in LibreDWG DWG class decoding CVSS 3.1MEDIUM 5.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences