CVE-2026-62254
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes; manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
Risk Assessment
Applications and tools parsing untrusted DWG files may hang or exhaust memory, causing denial of service. This requires a user or automated pipeline to open a malicious file.
Recommendation
Update LibreDWG to version 0.14 or later. Until updated, run parsing of untrusted files in a sandbox with memory limits.
Other vulnerabilities in LibreDWG
See all- CVE-2026-62250Medium
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails, and the no-advance check compares against oldpos saved before the loop. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed. The defect is fixed in version 0.14.8413.
- CVE-2026-54610Low
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which can cause a segmentation fault and denial of service or unexpected modification of mutable input.
- CVE-2023-36274High
LibreDWG versions 0.11 to 0.12.5 were found to contain a heap buffer overflow in the function bit_write_TF in bits.c.
- CVE-2023-36273High
Version 0.12.5 of LibreDWG was found to contain a heap buffer overflow vulnerability in the function bit_calc_CRC in bits.c.
- CVE-2023-36272High
Versions of LibreDWG from 0.10 to 0.12.5 were found to contain a heap buffer overflow vulnerability in the function bit_utf8_to_TU in bits.c.
- CVE-2023-36271High
LibreDWG versions 0.10 to 0.12.5 were found to contain a heap buffer overflow in the function bit_wcs2nlen at bits.c.
Original NVD description (English source)
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS