Lilith >_> of Cisco Talos discovered this vulnerability.

Cisco Talos recently discovered three vulnerabilities in LibreCAD’s libdfxfw open-source library.

This library reads and writes .dxf and .dwg files — the primary file format for vector graphics in CAD software. LibreCAD, a free computer-aided design software for 2-D models, uses this libdfxfw.

TALOS-2021-1349 (CVE-2021-21898) and TALOS-2021-1350 (CVE-2021-21899) can trigger buffer overflows if an attacker tricks the user into opening a specially crafted DWG file, eventually allowing the attacker to execute code on the victim machine. TALOS-2021-1351 (CVE-2021-21900) works in a similar manner, but with a DXF file instead. Cisco Talos worked with LibreCAD to ensure that these issues are resolved and an update is available for affected customers, all in adherence to Cisco’s vulnerability disclosure policy.

Users are encouraged to update these affected products as soon as possible: LibreCad libdxfrw, version 2.2.0-rc2-19-ge02f3580. Talos tested and confirmed these versions of the library could be exploited by this vulnerability.

The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 57967, 57968 and 57976 - 57979. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.