---
id: CVE-2026-62254
title: 'LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing'
summary: >-
  LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a
  specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in
  `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs
  `realloc` on…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-789
vendor: LibreDWG
product: libredwg
affected:
  - libredwg < 0.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T21:18:19.876055Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:12:55.917Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62254'
references:
  - url: >-
      https://github.com/LibreDWG/libredwg/security/advisories/GHSA-gp83-hcvh-g255
    label: >-
      https://github.com/LibreDWG/libredwg/security/advisories/GHSA-gp83-hcvh-g255
  - url: 'https://github.com/LibreDWG/libredwg/issues/1261'
    label: 'https://github.com/LibreDWG/libredwg/issues/1261'
  - url: >-
      https://github.com/LibreDWG/libredwg/commit/9de893a2e395ff5ac104a46cca54c5e2cf8f02cf
    label: >-
      https://github.com/LibreDWG/libredwg/commit/9de893a2e395ff5ac104a46cca54c5e2cf8f02cf
  - url: 'https://github.com/LibreDWG/libredwg/releases/tag/0.14'
    label: 'https://github.com/LibreDWG/libredwg/releases/tag/0.14'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05792
ingestedAt: '2026-11-05T16:24:31.474Z'
---

## Overview

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

## Affected

- `libredwg < 0.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.