Live › vulnerability › CVE-2026-62254
LibreDWG is a C library for reading and writing DWG CAD files. A specially crafted R13-R2000 DWG file forces an unbounded allocation loop in the class decoder, so parsing it causes denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Teams that link LibreDWG or run its tools to parse DWG files from outside sources, such as uploads or converters. Systems that only handle trusted, internal drawings are lower exposure. The sources say running the parser under memory limits is a workaround, not a fix.
No product ranges from the sources yet.
dwg2dxf --version if the tool is installed.0.14 (the sources say the issue is fixed in version 0.14; earlier versions are affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
This page as .md · .json · in your agent: get_signal("CVE-2026-62254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.