LibreDWG EUVD-2026-114462

Exploitation requires a victim application or user to parse an attacker-supplied DWG file in the R13-R2000 format range using LibreDWG prior to 0.14, with the crafted file carrying a manipulated num_classes field that drives the class-decoding loop in decode_R13_R2000. The limiting factors are significant: the CVSS vector shows AV:L and UI:R, so there is no remote network-triggered path on its own - the attacker must get the malicious file in front of a parser, and some user or automated process must actually process it. Impact is confined to availability (C:N/I:N/A:H), i.e. a slow-allocation hang or resource exhaustion of the parsing process, not code execution. The vendor states that running LibreDWG sandboxed with ulimit'ed memory is only a workaround, not a remediation; upgrading to 0.14 is the fix.

This is a genuine but limited-priority issue - a moderate-severity, availability-only denial of service, not a high-impact or actively exploited flaw. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: the attack is local and requires the victim to parse a crafted file (UI:R), with no confidentiality or integrity impact and only availability affected via algorithmic resource exhaustion. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. The vulnerability is NOT in CISA KEV, and no SSVC decision block was supplied; the only priority signal is the vuln.today 'this_month' label, which is consistent with a real-but-non-emergency DoS. No verified working exploit code is referenced - the available links are the vendor advisory, the tracking issue, the fix commit, and the release, and the issue itself frames the defect as something surfaced by fuzzing. The practical ceiling on risk is that the impact is a crash/hang of the parsing process (A:H), not code execution, so the realistic consequence is disruption of any service or workflow that ingests untrusted DWG files, rather than compromise.

An attacker crafts an R13-R2000 DWG file with a manipulated num_classes value and delivers it to a victim who opens or processes it with an application built on LibreDWG prior to 0.14 (for example a CAD viewer, converter, or automated ingestion pipeline). When decode_R13_R2000 parses the file, the unbounded per-iteration realloc loop forces an extremely slow allocation sequence, hanging or exhausting resources on the parsing host. No verified working exploit code is published; the defect was characterized as a fuzzing-reachable DoS.