CVE-2026-54610

The LibreDWG library (versions prior to 0.14 ) contains a vulnerability in the bit_TV_to_utf8() function located in src/bits.c. The root cause is that the function can perform an in-place write to the caller-provided src buffer—despite accepting const input—when an iconv() error (other than E2BIG...

CVE-2026-54610 LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, bitTVtoutf8 in src/bits.c can write to the caller-provided src buffer despite accepting const input. On an iconv error other than E2BIG, the function frees its output buffer and passes the original input alias to bituexpand,...