Live › vulnerability › CVE-2026-62250
LibreDWG is a C library for reading and writing DWG CAD files. A crafted pre-R13 DWG file makes the entity decoder loop forever, allocating objects until memory runs out and the process is killed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Any application or tool that calls dwg_read_file() on DWG files from untrusted sources, including dwg2dxf, dwgread and dwg2svg. Pipelines that only open trusted, internally produced DWG files are much less exposed. Systems that never parse DWG files can skip it.
No product ranges from the sources yet.
dwgread --version or check the LibreDWG version in the project's dependency manifest to see whether it is below 0.14.8413.libredwg to find which tools link it.0.14.8413 or later (repository nightly), as stated in the source.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwg_read_file() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.
This page as .md · .json · in your agent: get_signal("CVE-2026-62250")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.