{"id":"CVE-2026-62254","kind":"vulnerability","aliases":["CVE-2026-62254"],"related":[],"title":"LibreDWG: crafted DWG file makes parser loop and stall","description":"LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.","summary":"LibreDWG is a C library for reading and writing DWG CAD files. A specially crafted R13-R2000 DWG file forces an unbounded allocation loop in the class decoder, so parsing it causes denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cad","dwg-parsing","libredwg","package"],"not_affected_if":["trusted-input-only","version-0.14-or-later"],"how_to_check":"- Check the LibreDWG version in use, for example with `dwg2dxf --version` if the tool is installed.\n- Search your code and dependencies for the LibreDWG library and confirm whether it parses untrusted DWG files.","fix":"- LibreDWG `0.14` (the sources say the issue is fixed in version 0.14; earlier versions are affected).","status":"open","published_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:52+00:00","updated_at":"2026-10-30T21:26:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T21:26:52Z","model":"claude-haiku-5-5","output":{"fix":"- LibreDWG `0.14` (the sources say the issue is fixed in version 0.14; earlier versions are affected).","reach":"unknown","title":"LibreDWG: crafted DWG file makes parser loop and stall","impact":"low","summary":"LibreDWG is a C library for reading and writing DWG CAD files. A specially crafted R13-R2000 DWG file forces an unbounded allocation loop in the class decoder, so parsing it causes denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["libredwg","cad","dwg-parsing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"parsing a crafted file stalls the process, causing denial of service","analyst_note":"","how_to_check":"- Check the LibreDWG version in use, for example with `dwg2dxf --version` if the tool is installed.\n- Search your code and dependencies for the LibreDWG library and confirm whether it parses untrusted DWG files.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","version-0.14-or-later"],"who_is_affected":"Teams that link LibreDWG or run its tools to parse DWG files from outside sources, such as uploads or converters. Systems that only handle trusted, internal drawings are lower exposure. The sources say running the parser under memory limits is a workaround, not a fix.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4200,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62254':12A,15A '0.14':72C,148C 'algorithm':82C 'alloc':45B,115C 'c':25B,62C 'cad':16B,32B 'caus':54B 'check':104C 'class':49B,93C,107C 'class-decod':92C 'craft':2A,36B,75C 'cve':10A,13A 'decod':50B,86C,94C 'denial':55B,118C 'dwg':3A,18B,31B,40B,68C,79C 'dwg-pars':17B 'everi':99C 'exhaust':84C 'extrem':113C 'field':110C 'file':4A,33B,41B,69C,123C 'fix':145C 'forc':42B,111C 'free':61C 'issu':143C 'iter':100C 'librari':26B,63C 'libredwg':1A,20B,22B,58C 'limit':134C 'loop':7A,46B,95C,116C 'make':5A 'manipul':108C 'memori':133C 'num':106C 'packag':21B 'pars':19B,52B,125C 'parser':6A,128C 'perform':96C 'prior':70C 'r13':38B,77C,87C 'r13-r2000':37B,76C 'r2000':39B,78C,88C 'rather':138C 'read':28B,65C 'realloc':97C 'remedi':141C 'resourc':83C 'run':126C 'sandbox':131C 'saniti':103C 'servic':57B,120C 'slow':114C 'special':35B,74C 'src/decode.c':90C 'stall':9A 'trigger':81C 'unbound':44B 'version':147C 'without':101C 'workaround':137C 'write':30B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams that link LibreDWG or run its tools to parse DWG files from outside sources, such as uploads or converters. Systems that only handle trusted, internal drawings are lower exposure. The sources say running the parser under memory limits is a workaround, not a fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62254","severity":null,"published_at":"2026-10-30T21:17:13+00:00","modified_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}