LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
Affects LibreDWG versions before 0.14 when parsing a specially crafted R13-R2000 DWG file. Fixed in 0.14.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 0.14
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
LibreDWG, a free C library for reading and writing DWG files, is affected. A specially crafted R13-R2000 DWG file can cause the parser to consume excessive resources and slow down dramatically, leading to a denial of service when the file is opened.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- LibreDWG libredwg
fixed in 0.14
References 4
GitHub · LibreDWG/libredwg
Questions about CVE-2026-62254
What does this mean?
A specially crafted R13-R2000 DWG file can make the decode_R13_R2000 function fall into an extremely slow realloc loop while decoding classes. libredwg then hangs or stalls when it parses the file, which is a denial of service.Source: github.com
Am I affected, and how do I check?
LibreDWG versions before 0.14 are affected, and only when they parse R13-R2000 DWG files. Compare the installed libredwg version against 0.14 to see where it stands.Source: github.com
What should I do about it?
Upgrade libredwg to 0.14, where the fix is included. If an upgrade is not possible yet, the advisory's workaround is to run libredwg in a sandbox with ulimit-limited memory.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data