{"id":"CVE-2026-62250","kind":"vulnerability","aliases":["CVE-2026-62250"],"related":[],"title":"LibreDWG: crafted pre-R13 DWG file exhausts memory and crashes readers","description":"LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.","summary":"LibreDWG is a C library for reading and writing DWG CAD files. A crafted pre-R13 DWG file makes the entity decoder loop forever, allocating objects until memory runs out and the process is killed.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cad-pipelines","dwg2dxf","dwg2svg","dwgread","libredwg","package"],"not_affected_if":["no-dwg-parsing","trusted-files-only"],"how_to_check":"- Run `dwgread --version` or check the LibreDWG version in the project's dependency manifest to see whether it is below `0.14.8413`.\n- Search build and dependency files for `libredwg` to find which tools link it.","fix":"- Move LibreDWG to `0.14.8413` or later (repository nightly), as stated in the source.","status":"open","published_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:53+00:00","updated_at":"2026-10-30T21:26:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:26:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move LibreDWG to `0.14.8413` or later (repository nightly), as stated in the source.","reach":"local","title":"LibreDWG: crafted pre-R13 DWG file exhausts memory and crashes readers","impact":"low","summary":"LibreDWG is a C library for reading and writing DWG CAD files. A crafted pre-R13 DWG file makes the entity decoder loop forever, allocating objects until memory runs out and the process is killed.","audience":"developers","category":"package","nicknames":[],"who_cares":["libredwg","cad-pipelines","dwg2dxf","dwgread","dwg2svg"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Process exhausts memory and is killed, causing denial of service","analyst_note":"","how_to_check":"- Run `dwgread --version` or check the LibreDWG version in the project's dependency manifest to see whether it is below `0.14.8413`.\n- Search build and dependency files for `libredwg` to find which tools link it.","plain_action":"","needs_analyst":false,"not_affected_if":["no-dwg-parsing","trusted-files-only"],"who_is_affected":"Any application or tool that calls `dwg_read_file()` on DWG files from untrusted sources, including `dwg2dxf`, `dwgread` and `dwg2svg`. Pipelines that only open trusted, internally produced DWG files are much less exposed. Systems that never parse DWG files can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4459,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62250':15A,18A '0.14.8413':77C,260C '1131':216C 'advanc':144C,160C 'alloc':52B,96C,177C,183C 'applic':217C 'associ':211C 'attack':248C 'autom':241C 'bit':136C,140C 'bound':120C 'byte':146C 'c':30B,67C 'cad':20B,37B 'cad-pipelin':19B 'call':220C 'calle':122C 'chang':210C 'check':161C 'clamp':123C,205C 'compar':162C 'comput':106C 'constant':196C 'constant-memori':195C 'control':113C 'cpu':198C 'craft':2A,40B,79C 'crash':11A 'credenti':249C 'cve':13A,16A 'dat':126C,145C,154C 'decod':49B,86C,102C 'defect':201C 'denial':234C 'dwg':6A,36B,44B,73C,83C,179C,221C 'dwg2dxf':22B,228C 'dwg2svg':23B,231C 'dwgread':24B,229C 'earlier':214C 'end':118C,124C,133C,152C 'enter':91C 'entiti':48B,88C,114C,117C 'entri':181C 'equal':153C 'exhaust':8A 'fail':150C,184C 'file':7A,38B,45B,74C,112C,223C,226C,246C 'file-control':111C 'fix':255C 'forev':51B 'free':66C 'guard':149C 'hang':199C 'header':119C 'includ':227C 'input':135C 'instead':169C 'issu':215C,253C 'iter':101C,173C 'kill':62B,191C 'leav':175C 'librari':31B,68C 'libredwg':1A,25B,27B,63C 'loop':50B,94C,168C 'make':46B,85C 'malform':245C 'memori':9A,55B,197C 'mere':193C 'never':129C 'new':98C 'night':258C 'no-adv':158C 'no-progress':207C 'nontermin':93C 'object':53B,99C,180C 'oldpo':164C 'oom':190C 'oom-kil':189C 'open':243C 'overflow':148C 'packag':26B 'pipelin':21B,242C 'pre':4A,42B,81C 'pre-r13':3A,41B,80C 'prer13':87C,103C 'previous':172C 'prior':75C 'process':60B,187C 'progress':209C 'r13':5A,43B,82C 'raw':110C 'rc':138C 'read':33B,70C,137C,141C,222C 'reader':12A 'recalcul':130C 'remain':202C 'repeat':176C 'repositori':257C 'requir':251C 'rs':142C 'run':56B 'save':165C 'servic':236C 'size':107C,127C,131C,155C 'src/decode.c':90C 'src/decode_r11.c':105C 'start':115C 'stop':143C 'suffer':233C 'tool':219C 'untrust':225C 'user':239C 'version':259C 'write':35B,72C","nicknames":[],"mitigations":[],"who_affected":"Any application or tool that calls `dwg_read_file()` on DWG files from untrusted sources, including `dwg2dxf`, `dwgread` and `dwg2svg`. Pipelines that only open trusted, internally produced DWG files are much less exposed. Systems that never parse DWG files can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62250","severity":null,"published_at":"2026-10-30T21:17:13+00:00","modified_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}