{"affected":[{"product":"libredwg","source":"CNA: GitHub_M","vendor":"LibreDWG","versions":[{"status":"affected","version":"< 0.14"}]},{"ecosystem":"c/c++","packageName":"LibreDWG","product":"LibreDWG","source":"GitHub GHSA-5p98-8245-6hxq","vendor":"","versions":[{"status":"affected","version":"<= 0.13.4.8236，","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-54610","cwes":["CWE-471","CWE-703"],"description":"LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bit_read_TV(). This issue is fixed in version 0.14.","epss":{"date":"2026-11-04","percentile":0.01731,"score":0.00118},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"}],"kev":null,"metrics":[{"score":3.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},{"score":3.3,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793846863120,"publishedAt":1793392759805,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LibreDWG/libredwg/commit/08c034a224a4e9512b1cd62e74b5cf081a4cfa89"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LibreDWG/libredwg/releases/tag/0.14"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/user-attachments/files/28631091/libredwg-bit-tv-to-utf8-submission.tar.gz"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/LibreDWG/libredwg/commit/08c034a224a4e9512b1cd62e74b5cf081a4cfa89"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/LibreDWG/libredwg/releases/tag/0.14"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/user-attachments/files/28631091/libredwg-bit-tv-to-utf8-submission.tar.gz"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-5p98-8245-6hxq","text":"LibreDWG (c/c++): GitHub reports patched versions 0.14. Check the advisory for the affected release branch.","url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"}],"revision":"4f3ff448488895b31737417b81b3219c6099daf3ca501ed1f6b61af75263554e","sources":[{"modifiedAt":1793846863120,"name":"CNA: GitHub_M","retrievedAt":1793848242368,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54610"},{"modifiedAt":1793648133347,"name":"NVD","retrievedAt":1793665691543,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54610"},{"modifiedAt":1782579305000,"name":"GitHub Security Advisories","retrievedAt":1793850909562,"url":"https://github.com/LibreDWG/libredwg/security/advisories/GHSA-5p98-8245-6hxq"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848265994,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54610"}],"ssvc":{"assessedAt":1793846834068,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling","updatedAt":1793850909562}