LibreCAD and its libdxfrw library suffer a stack-based out-of-bounds read when parsing the header of a DWG file. The flaw arises in dwgReader18::readFileHeader() when a non‑NUL‑terminated string is passed to strlen, allowing an attacker’s crafted AC1018, AC1024 or AC1027 DWG file to trigger a read beyond the intended buffer. The result is a crash of the consuming application, disrupting service without exposing data or permitting code execution. This vulnerability is listed under CWE-125.

All installations of LibreCAD up to version 2.2.1.5 and libdxfrw up to LC2.2.0 are affected. The issue resides in the DWG file parsing component of these products.

The CVSS score of 4.8 reflects moderate risk. EPSS score is < 1%, and it is not listed in CISA’s KEV catalog. Attackers must supply a malicious DWG file to the targeted application, making this a local or privilege‑based vulnerability rather than a remote exploit. If an attacker gains the ability to supply such files—directly or via a user—they can cause denial of service by crashing LibreCAD. The exploit requires only the presence of the vulnerable library and a crafted file, with no network interaction needed.