---
id: "CVE-2026-62250"
kind: "vulnerability"
aliases: ["CVE-2026-62250"]
title: "LibreDWG: crafted pre-R13 DWG file exhausts memory and crashes readers"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cad-pipelines", "dwg2dxf", "dwg2svg", "dwgread", "libredwg", "package"]
not_affected_if: ["no-dwg-parsing", "trusted-files-only"]
published_at: "2026-10-30T21:17:13+00:00"
first_seen_at: "2026-10-30T21:25:53+00:00"
updated_at: "2026-10-30T21:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62250", "first_seen_at": "2026-10-30T21:25:53+00:00"}]
---

# LibreDWG: crafted pre-R13 DWG file exhausts memory and crashes readers

LibreDWG is a C library for reading and writing DWG CAD files. A crafted pre-R13 DWG file makes the entity decoder loop forever, allocating objects until memory runs out and the process is killed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `dwgread --version` or check the LibreDWG version in the project's dependency manifest to see whether it is below `0.14.8413`.
- Search build and dependency files for `libredwg` to find which tools link it.

## Fix

- Move LibreDWG to `0.14.8413` or later (repository nightly), as stated in the source.

## Timeline

- 2026-10-30T21:25:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62250

## From the sources

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_