LibreDWG is a free C library for reading and writing DWG files. The vulnerability resides in the pre‑R13 entity decoding routine, where a crafted DWG file causes the decode_preR13_entities() function to enter a non‑terminating loop that repeatedly allocates memory for new DWG objects until the process exhausts available memory or is killed. This results in a denial of service that can affect any application or tool calling dwg_read_file(), such as dwg2dxf, dwgread, or dwg2svg. The weakness is an unbounded memory allocation and infinite loop, corresponding to CWE‑400 and CWE‑835. Based on the description, it is inferred that no attacker credentials are required and that the vulnerability can be triggered simply by supplying a malicious DWG file to the library.

The LibreDWG library, identified as LibreDWG:libredwg, is affected. All releases prior to version 0.14.8413 contain the flaw. This includes the open‑source versions distributed with various CAD tools and automation pipelines that rely on the library to process DWG files.

The CVSS score of 5.5 indicates a moderate severity, and although the EPSS score is not available, the lack of a KEV listing suggests that the vulnerability may not yet be widely exploited. The attack vector is driven by providing a malicious DWG file to any process that uses the library; no elevated privileges are required, making local or remote exploitation straightforward. If a service accepts files over a network, the risk extends to remote denial of service. The vulnerability does not lead to code execution or privilege escalation, but it can render dependent applications unusable by exhausting available memory.