Security readout for executives and security teams
Plain-English summary
LibreDWG had a heap-based buffer overflow in DWG parsing code through v0.10.1.3751. The public record does not provide a severity score, confirmed impact, or fixed version. Treat this as a potentially risky file-parsing issue where exposure depends on whether your systems process DWG files with LibreDWG.
Executive priority
Prioritize assessment if the business processes external or customer-supplied DWG files. If LibreDWG is absent, urgency is low. If present in automated file workflows, contain exposure while engineering confirms vendor remediation.
Technical view
CVE-2021-39522 describes a heap-based buffer overflow in bit_wcs2len() in bits.c in LibreDWG through v0.10.1.3751. The source bundle does not list CVSS, CWE, affected CPEs, exploitability details, or remediation metadata beyond the GitHub issue reference.
Likely exposure
Exposure is most likely in software, conversion services, pipelines, or analysis tools that use LibreDWG to parse DWG files, especially versions through v0.10.1.3751. The provided records do not identify specific downstream products or deployment patterns.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation. Because this is a parser memory-safety issue, risk may rise where untrusted DWG files are accepted or processed automatically.
Researcher notes
The public bundle is sparse: no CVSS, CWE, patch version, proof-of-concept status, or impact analysis is provided. Analysis should stay anchored to the GitHub issue and CVE record, then verify current upstream guidance before assigning exploitability or remediation claims.
Mitigation direction
- Identify any direct or embedded LibreDWG usage.
- Check LibreDWG vendor guidance and issue 255 for remediation status.
- Avoid processing untrusted DWG files until exposure is understood.
- Run DWG parsing in sandboxed, least-privilege environments.
- Restrict automated DWG ingestion from external sources.
Validation and detection
- Inventory installed LibreDWG versions and embedded copies.
- Confirm whether versions are through v0.10.1.3751.
- Map workflows that process DWG files automatically.
- Review logs for crashes during DWG parsing.
- Check dependency scanners for LibreDWG presence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-39522 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/LibreDWG/libredwg/issues/255CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.