Denial of Service Vulnerability in LibreDWG Affected by Malicious DWG Files

CVE-2026-62250

What is CVE-2026-62250?

LibreDWG, a free C library for reading and writing DWG files, contains a vulnerability that allows crafted pre-R13 DWG files to trigger a nonterminating loop in the decode_preR13_entities() function. This flaw can result in excessive memory allocation and lead to denial of service attacks when untrusted files are processed. Applications utilizing dwg_read_file(), like dwg2dxf, dwgread, and dwg2svg, are particularly susceptible, as they do not require any authentication for exploitation. Affected users should upgrade to version 0.14.8413 or later to mitigate this issue.

References