Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62254— LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing

Quick assessment

Affected
LibreDWG libredwg
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreDWG 是一个用于读写 DWG 文件的免费 C 库。在 0.14 版本之前，经过特殊构造的 R13 至 R2000 版本的 DWG 文件可触发 中 函数的算法性资源耗尽漏洞。该漏洞源于类解码循环在每次迭代时均执行 操作，却未对 字段进行有效性检查。攻击者通过操纵该字段，可强制解析器进入极慢的内存分配循环，从而导致拒绝服务（DoS）。在沙箱环境中运行解析器并限制内存使用仅是一种临时缓解措施，而非根本性修复方案。该问题已在 0.14 版本中得到修复。

CVSS 5.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62254

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
Source: CVE Program / CVE List V5
Vulnerability Description
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LibreDWG libredwg < 0.14 -

II. Public POCs for CVE-2026-62254

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62254

请登录查看更多情报信息。

Vendor Pages for CVE-2026-62254 (1)

Other References for CVE-2026-62254 (3)

Same Patch Batch · LibreDWG · 2026-10-30 · 3 CVEs total

CVE-2026-62250 5.5 MEDIUM LibreDWG: unbounded allocation in pre-R13 DWG entity decoding
CVE-2026-54610 3.3 LOW LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

IV. Related Vulnerabilities

Same product: libredwg
Same vendor: LibreDWG
Same weakness: CWE-400