LiveActive security incident?Get immediate response
CVE Record

CVE-2020-21844: GNU LibreDWG 0.10 is affected by: memcpy-param-overlap.

GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. The impact is: execute arbitrary code (remote). The component is: read_2004_section_header ../../src/decode.c:2580.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-21844 describes a memory-copy overlap flaw in GNU LibreDWG 0.10. The public record claims possible remote arbitrary code execution when vulnerable LibreDWG code processes affected DWG content. The available sources do not provide CVSS, detailed affected CPEs, or confirmed exploitation.

Executive priority

Treat this as high priority only for environments processing untrusted DWG files with LibreDWG 0.10. If LibreDWG is absent or used only offline with trusted files, urgency is lower but inventory should still be completed.

Technical view

The flaw is reported as memcpy-param-overlap in read_2004_section_header within src/decode.c around line 2580. The vulnerable component is tied to DWG decoding in GNU LibreDWG 0.10. Public metadata does not include CWE mapping, patch details, or exploit validation.

Likely exposure

Exposure is most likely where GNU LibreDWG 0.10 is installed directly or embedded in DWG import, conversion, indexing, preview, or security-scanning workflows that handle untrusted DWG files.

Exploitation context

CISA KEV status is false, and the supplied sources do not show active exploitation. The CVE description states remote arbitrary code execution impact, but supporting technical detail is limited.

Researcher notes

The public record is sparse: affected CPEs, CVSS, CWE, exploit status, and patch information are missing from the supplied bundle. The clearest lead is the linked LibreDWG GitHub issue comment and the named decode.c function.

Mitigation direction

  • Inventory systems and applications that use GNU LibreDWG or libredwg.
  • Prioritize review of services processing DWG files from external users or partners.
  • Restrict untrusted DWG ingestion until vendor guidance is confirmed.
  • Run DWG processing in isolated, least-privileged environments.
  • Check LibreDWG project guidance for a fixed release or recommended workaround.

Validation and detection

  • Confirm whether GNU LibreDWG 0.10 is present in packages, containers, or bundled dependencies.
  • Map all workflows that parse, convert, preview, or index DWG files.
  • Review crash, sanitizer, or application logs related to DWG parsing.
  • Verify any remediation against official LibreDWG or CVE guidance.
  • Retest business DWG workflows after applying vendor-recommended changes.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-21844 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.