Denial of Service Vulnerability in LibreDWG Library by LibreDWG

CVE-2026-62254

What is CVE-2026-62254?

The LibreDWG library, designed for reading and writing DWG files, contains a vulnerability that may lead to denial of service due to algorithmic resource exhaustion. Specifically, prior to version 0.14, a specially crafted R13-R2000 DWG file can exploit the decode_R13_R2000 function in src/decode.c. The function's class-decoding loop incorrectly reallocates memory without proper checks on num_classes, resulting in a prolonged allocation loop that can crash the parser. Users are encouraged to upgrade to version 0.14 to mitigate this issue, as running the parser in a memory-limited sandbox is only a temporary workaround.

References