LibreCAD is a niche, open-source computer-aided design application whose vulnerability footprint is concentrated in the core drawing and DXF-file-handling components (LibreCAD and LibDXFRW). The recurring weakness classes—out-of-bounds writes, buffer overflows, memory-buffer boundary violations, NULL pointer dereferences, and out-of-bounds reads—reflect the memory-safety challenges inherent to native C++ codebases that parse untrusted CAD file formats. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Librecad over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-45341HIGH A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW documen | Jan 25, 2022 | 8.8 | 32 | NO | NO |
CVE-2021-21898HIGH A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an o | Nov 19, 2021 | 8.8 | 29 | NO | NO |
CVE-2021-21900HIGH A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after- | Nov 19, 2021 | 8.8 | 29 | NO | NO |
CVE-2021-21899HIGH A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a h | Nov 19, 2021 | 8.8 | 29 | NO | NO |
CVE-2021-45342HIGH A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW documen | Jan 25, 2022 | 7.8 | 27 | NO | NO |
CVE-2018-19105HIGH LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafte | Nov 8, 2018 | 7.8 | 25 | NO | NO |
CVE-2021-45343MEDIUM In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document. | Jan 25, 2022 | 5.5 | 21 | NO | NO |
CVE-2023-30259MEDIUM A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file. | Jun 28, 2023 | 5.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Librecad.
Media articles that mention a CVE ID that affects a product developed by Librecad — matched by CVE ID, not by vendor name.