LibreDWG CVE-2026-62250

Exploitation requires the target to parse an attacker-supplied, untrusted pre-R13 DWG file (the minimized PoC uses the AC1.40 magic header) through dwg_read_file() using an affected LibreDWG build (<=0.14, prior to nightly 0.14.8413); all bundled tools sharing this decode path are affected, including dwg2dxf, dwgread and dwg2svg. No authentication or privileges are required (PR:N). Limiting factors: impact is availability-only (process memory exhaustion/OOM-kill - no code execution, data disclosure or integrity loss); the file must actually be opened/processed by a user or an automated pipeline (UI:R), so the attacker needs a delivery channel into such a workflow; and the specific trigger path is the pre-R13 entity decoder, so only files reaching that decoder are relevant.

This is a genuine but bounded issue - a denial-of-service only, not a path to code execution or data exposure. The NVD vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) reflects that: the only impact metric set is A:H, with C:N and I:N. The LibreDWG advisory independently scores it AV:N (6.5 Medium); this attack-vector disagreement is unresolved in the available data - AV:L fits a user opening a file in a local tool, while AV:N fits an untrusted file reaching a network-facing converter or CI pipeline, so the real figure depends on deployment. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or probable exploitation; exploitation status is best described as a public PoC reference existing (see below) rather than confirmed exploitation. The vuln.today decision label is 'this_month', i.e. prioritized but explicitly not an emergency - consistent with a credible, reproducible DoS that lacks the integrity/confidentiality impact or active-exploitation evidence that would justify emergency handling. Net: a real, worth-patching availability bug for anyone parsing untrusted DWG files, not a high-CVSS-but-low-real-risk phantom, but also not a drop-everything priority.

An attacker crafts a malformed pre-R13 DWG file (magic header AC1.40) and delivers it to a target that parses DWGs via LibreDWG - for example a document-conversion service, a CAD viewer, or a CI asset pipeline that runs dwg2dxf, dwgread or dwg2svg. When dwg_read_file() processes the file, decode_preR13_entities() enters a nonterminating loop that allocates a new object every iteration, consuming memory without bound until the process is OOM-killed or realloc fails. The GHSA advisory includes a verified 496-byte minimized PoC and reproduction steps, so the trigger is demonstrated rather than theoretical.