LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwg_read_file() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…bredwg/security/advisories/GHSA-7625-26gc-xqvp Diğer
• github.com/LibreDWG/libredwg/issues/1131 Diğer
• github.com/…ommit/4e14952c43be5b8feff6e54a61af3425d6ca95a4 Diğer
• github.com/LibreDWG/libredwg/releases/tag/0.14.8413 Diğer

Kayıt geçmişi

1. 30 Eki 2026 23:37Yayımlandı

İlgili açıklar

• 3,3 CVE-2026-54610LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling
• 5,5 CVE-2026-62254LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
• 7,5 CVE-2026-63341Aedes has Uncaught Exception and Uncontrolled Resource Consumption
• 6,5 CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources
• 5,9 CVE-2026-62303Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
• 6,3 CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumption