LibreDWG up to 0.14.8396 Dwg Decoder src/decode.c decode_preR13_entities size infinite loop

Summaryinfo

A vulnerability has been found in LibreDWG and classified as problematic. This issue affects the function decode_preR13_entities of the file src/decode.c of the component Dwg Decoder. Performing a manipulation of the argument size results in infinite loop. This vulnerability is identified as CVE-2026-62250. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in LibreDWG. This affects the function decode_preR13_entities of the file src/decode.c of the component Dwg Decoder. The manipulation of the argument size with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. The summary by CVE is:

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-62250 since 07/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 0.14.8413 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Image Processing Software

Name

• LibreDWG

Version

• 0.5.1036
• 0.5.1048
• 0.7
• 0.7.1645
• 0.9.3.2564
• 0.10
• 0.10.1
• 0.10.2641
• 0.10.2641vi
• 0.11
• 0.12.3
• 0.12.4
• 0.12.4.4608
• 0.12.4.4643
• 0.12.5
• 0.12.5.6384
• 0.13.3.7835
• 0.13.4
• 0.13.4-154-g0b573035
• 0.14
• 0.14.8396

Website

• Product: https://github.com/LibreDWG/libredwg/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion