LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling
Affects LibreDWG 0.13.4.8236 and earlier, in bit_TV_to_utf8() in src/bits.c when iconv() fails with an error other than E2BIG. CVSS rates it Low, and the fix is in 0.14.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 0.14
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
LibreDWG, a free C library for reading and writing DWG (AutoCAD drawing) files, is affected in its character-conversion routine. Applications that pass untrusted or immutable input into this conversion function can have that input modified, which may cause a crash and denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- LibreDWG libredwg
fixed in 0.14
References 4
GitHub · LibreDWG/libredwg
GitHub · user-attachments/files
Questions about CVE-2026-54610
What does this mean?
The bug is in the error handling of bit_TV_to_utf8(). When iconv() fails with an error other than E2BIG, a read-only string such as a literal can cause a segmentation fault, and mutable caller-owned input can be modified before it is returned.Source: github.com
Am I affected, and how do I check?
LibreDWG 0.13.4.8236 and earlier are affected, in the bit_TV_to_utf8() path in src/bits.c when iconv() fails with an error other than E2BIG. To check, compare the installed LibreDWG version with 0.13.4.8236.Source: github.com
What should I do about it?
Upgrade to LibreDWG 0.14 or later, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data