CVE-2026-62250— LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

Quick assessment

Affected

LibreDWG libredwg

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreDWG 是一个用于读写 DWG 文件的免费 C 语言库。在版本 0.14.8413 之前，精心构造的 R13 之前版本（pre-R13）的 DWG 文件会导致中的函数进入一个非终止循环，且该循环在每次迭代时都会分配一个新对象。中的函数根据原始文件中由攻击者控制的和头边界来计算；虽然被调用函数会将限制（clamp）在范围内，但从未重新计算。当处理到输入数据末尾时，和停止推进指针；由于等于，溢出防护检查失效；而“无进展”检查（no-advance check）是与循环开始前保存的

CVSS 5.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

Source: CVE Program / CVE List V5

Vulnerability Description

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不可达退出条件的循环(无限循环)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
LibreDWG	libredwg	< 0.14.8413	-

II. Public POCs for CVE-2026-62250

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62250

请登录查看更多情报信息。

Other References for CVE-2026-62250 (4)

https://github.com/LibreDWG/libredwg/issues/1131 x_refsource_MISC
https://github.com/LibreDWG/libredwg/releases/tag/0.14.8413 x_refsource_MISC
https://github.com/LibreDWG/libredwg/security/advisories/GHSA-7625-26gc-xqvp x_refsource_CONFIRM
https://github.com/LibreDWG/libredwg/commit/4e14952c43be5b8feff6e54a61af3425d6ca95a4 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62250

Same Patch Batch · LibreDWG · 2026-10-30 · 3 CVEs total

CVE-2026-62254	5.5 MEDIUM	LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
CVE-2026-54610	3.3 LOW	LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

IV. Related Vulnerabilities

Same product: libredwg

Same vendor: LibreDWG

Same weakness: CWE-835