CVE catalog

CVE-2021-21898

librecad: CVE-2021-21898

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.60% · Oct 25, 2026

A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibrecadsid2.2.0.2-3fixed
Debianlibrecadforky2.2.0.2-3fixed
Debianlibrecadtrixie2.2.0.2-1fixed
Debianlibrecadbookworm2.2.0-1fixed
Ubuntulibrecadpro2.1.2-1vulnerable
Ubuntulibrecadpro2.1.2-1ubuntu0.1~esm1fixed
Ubuntulibrecad18.042.1.2-1vulnerable
Ubuntulibrecad18.042.1.2-1ubuntu0.1fixed
Ubuntulibrecad20.042.1.3-1.2vulnerable
Ubuntulibrecad20.042.1.3-1.2build1vulnerable
Ubuntulibrecad20.042.1.3-1.2+deb10u1build0.20.04.1fixed
Ubuntulibrecad22.042.1.3-1.3vulnerable
Ubuntulibrecad22.042.1.3-3fixed
Suselibdxfrwpackage hub 15 sp31.0.1+git.20220109-bp153.2.3.1fixed
Suselibrecadpackage hub 15 sp32.2.0~rc3-bp153.2.3.1fixed
Opensuselibdxfrwleap 15.31.0.1+git.20220109-bp153.2.3.1fixed
Opensuselibrecadleap 15.32.2.0~rc3-bp153.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibrecadsourcesid2.1.3-2not yet assignedNot reportedNot reported
Debianlibrecadsourceforky2.1.3-2not yet assignedNot reportedNot reported
Debianlibrecadsourcetrixie2.1.3-2not yet assignedNot reportedNot reported
Debianlibrecadsourcebookworm2.1.3-2not yet assignedNot reportedNot reported
Ubuntulibrecaddebpro2.1.2-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-21898Not reported
Ubuntulibrecaddeb18.042.1.2-1ubuntu0.1Not reportedUBUNTU-CVE-2021-21898Not reported
Ubuntulibrecaddeb20.042.1.3-1.2+deb10u1build0.20.04.1Not reportedUBUNTU-CVE-2021-21898Not reported
Ubuntulibrecaddeb22.042.1.3-3Not reportedUBUNTU-CVE-2021-21898Not reported
Suselibdxfrwrpmpackage hub 15 sp31.0.1+git.20220109-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0067-1Not reported
Suselibrecadrpmpackage hub 15 sp32.2.0~rc3-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0067-1Not reported
Opensuselibdxfrwrpmleap 15.31.0.1+git.20220109-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0067-1Not reported
Opensuselibrecadrpmleap 15.32.2.0~rc3-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0067-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [librecad]Fixed
    Details (2)

    • 2.2.0-1 · amd64 · bookworm

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · bookworm; dsa · librecad · debian · 12

    • 2.2.0-1 · arm64 · bookworm

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · bookworm; dsa · librecad · debian · 12

  • [librecad-data]Fixed

    Source package: [librecad]

    Details (2)

    • 2.2.0-1 · all · bookworm

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · bookworm; dsa · librecad · debian · 12

    • 2.2.0-1 · all · bookworm

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · bookworm; dsa · librecad · debian · 12

[Debian 13 (Trixie)]

  • [librecad]Fixed

    Source package: [librecad]

    Details (2)

    • 2.2.0.2-1+b1 · amd64 · trixie

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · 13

    • 2.2.0.2-1+b2 · arm64 · trixie

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · 13

  • [librecad-data]Fixed

    Source package: [librecad]

    Details (2)

    • 2.2.0.2-1 · all · trixie

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · 13

    • 2.2.0.2-1 · all · trixie

      Fixed · Fixed: 2.1.3-2

      dsa · librecad · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]