Description
A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ribbonsoft | Ribbonsoft dxflib 3.17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cloudcompare | 2.11.3-7.1 | — |
| Debian 14 | dxflib | 3.26.4-1 | — |
| Debian 14 | librecad +1 | No fix yet | — |
| Debian 13 | cloudcompare | 2.11.3-7.1 | — |
| Debian 13 | dxflib | 3.26.4-1 | — |
| Debian 13 | librecad +1 | No fix yet | — |
| Debian 12 | cloudcompare | 2.11.3-7.1 | — |
| Debian 12 | dxflib | 3.26.4-1 | — |
| Debian 12 | librecad +1 | No fix yet | — |
| Debian 9 | librecad | 2.1.2-1+deb9u4 | DLA-3046-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dxflib | No fix yet | — |
| Ubuntu 26.04 LTS | dxflib | No fix yet | — |
| Ubuntu 25.10 | dxflib | No fix yet | — |
| Ubuntu 24.04 LTS | dxflib | No fix yet | — |
| Ubuntu 22.04 LTS | dxflib | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | dxflib | No fix yet | — |
| Ubuntu 18.04 LTS | dxflib | No fix yet | — |
| Ubuntu 16.04 LTS | dxflib | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dxflib | 3.26.4-1.1 | openSUSE-SU-2024:10730-1 |
Advisories 2
- DLA-3046-1 librecad - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10730-1 dxflib-devel-3.26.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1346
- FEDORA-2022-635599924b vendor-advisory
- [debian-lts-announce] 20220607 [SECURITY] [DLA 3046-1] librecad security update mailing-list
- FEDORA-2022-8d01b8b6d3 vendor-advisory
- FEDORA-2022-9d17930140 vendor-advisory
- FEDORA-2022-9cbdf39a5a vendor-advisory