LibreDWG up to 0.13 DWG Parser src/decode.c decode_R13_R2000 resource consumption

Summaryinfo

A vulnerability classified as problematic was found in LibreDWG up to 0.13. Affected by this issue is the function decode_R13_R2000 of the file src/decode.c of the component DWG Parser. The manipulation results in resource consumption. This vulnerability was named CVE-2026-62254. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in LibreDWG up to 0.13. Affected is the function decode_R13_R2000 of the file src/decode.c of the component DWG Parser. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-62254 since 07/13/2026. The exploitability is told to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 0.14 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Image Processing Software

Name

• LibreDWG

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13

Website

• Product: https://github.com/LibreDWG/libredwg/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion