---
id: CVE-2026-111167
title: >-
  GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read
  vulnerability in the AcDs decoder acds_private() that allows attackers to read
  beyond a static table via an unchecked schema property type index
summary: >-
  GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read
  vulnerability in the AcDs decoder acds_private() that allows attackers to read
  beyond a static table via an unchecked schema property type index. Attackers
  can supply a …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: GNU
product: LibreDWG
affected:
  - LibreDWG <= 0.14.8612
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:32.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111167'
references:
  - url: 'https://github.com/LibreDWG/libredwg'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LibreDWG/libredwg/blob/d9468ae948b8f07a08efa756c19f8916052358c0/src/acds.spec#L250-L260
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind-pwn/libredwg-acds-schema-prop-type-oob-read'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gnu-libredwg-through-0.14.8612-out-of-bounds-read-in-acds-private-acds-decoder
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T19:25:46.424Z'
---

## Overview

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.