What is the CVSS score of CVE-2023-26157?

CVE-2023-26157 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Libredwg are affected by CVE-2023-26157?

CVE-2023-26157 presents moderate security risk, a resource exhaustion vulnerability rated CVSS 5.5. Service availability could be impacted. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2023-26157?

Yes, a public proof-of-concept exploit is available for CVE-2023-26157. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2023-26157?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Libredwg CVE-2023-26157

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2024-01-02 report@snyk.io

Denial Of Service Buffer Overflow Libredwg

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:33 vuln.today

Patch released

Mar 28, 2026 - 19:33 nvd

Patch available

PoC Detected

Nov 21, 2024 - 07:50 vuln.today

Public exploit code

CVE Published

Jan 02, 2024 - 05:15 nvd

MEDIUM 5.5

DescriptionCVE.org

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.

AnalysisAI

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c. Affected products include: Gnu Libredwg. Version information: before 0.12.5.6384.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.