CVE-2025-61154: LibreDWG Heap Buffer Overflow DoS Flaw

CVE-2025-61154 Overview

A heap buffer overflow vulnerability has been identified in LibreDWG, an open-source library for reading and writing DWG files. The vulnerability exists in versions v0.13.3.7571 through v0.13.3.7835 and can be triggered when processing a specially crafted DWG file. The flaw resides in the decompress_R2004_section function within decode.c, which fails to properly validate buffer boundaries during decompression operations.

Critical Impact

Attackers can exploit this vulnerability by enticing users to open a maliciously crafted DWG file, leading to Denial of Service (DoS) conditions. The heap buffer overflow could cause application crashes and service disruption in any software utilizing the vulnerable LibreDWG library.

Affected Products

• LibreDWG v0.13.3.7571
• LibreDWG v0.13.3.7835
• All LibreDWG versions between v0.13.3.7571 and v0.13.3.7835

Discovery Timeline

• 2026-03-12 - CVE-2025-61154 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-61154

Vulnerability Analysis

This heap buffer overflow vulnerability occurs during the decompression of R2004-format DWG file sections. The decompress_R2004_section function in decode.c processes compressed data streams from DWG files without adequately validating the size of data being written to heap-allocated buffers. When a malformed DWG file containing manipulated compression metadata is processed, the function may attempt to write data beyond the allocated buffer boundaries, corrupting adjacent heap memory.

The R2004 format introduced a compression scheme for DWG files that LibreDWG must decompress when parsing. The vulnerability specifically manifests when the compressed data specifies output lengths that exceed the buffer capacity allocated by the library, leading to heap corruption and subsequent application instability.

Root Cause

The root cause of this vulnerability is insufficient bounds checking in the decompress_R2004_section function. When processing compressed sections from DWG files, the function does not properly validate that the decompressed output size matches the allocated buffer size. This allows an attacker to craft a DWG file with malicious compression parameters that cause the decompression routine to overflow the destination buffer on the heap.

Attack Vector

The attack vector requires user interaction where a victim must open or process a maliciously crafted DWG file using an application that incorporates the vulnerable LibreDWG library. Attack scenarios include:

1. Direct File Opening: An attacker sends a malicious DWG file via email or file sharing, targeting users of CAD applications or DWG viewers built with LibreDWG
2. Automated Processing: Systems that automatically process DWG files (such as document management systems or file conversion services) could be targeted by uploading malicious files
3. Web Applications: Web-based DWG preview or conversion services using LibreDWG could be exploited by uploading crafted files

The vulnerability exploitation results in application crashes due to heap corruption, causing Denial of Service. While the current assessment indicates DoS impact, heap buffer overflows can potentially be leveraged for more severe attacks depending on the memory layout and exploitation techniques.

Detection Methods for CVE-2025-61154

Indicators of Compromise

• Unexpected crashes in applications processing DWG files, particularly those referencing decompress_R2004_section or decode.c in crash logs
• Memory corruption errors or segmentation faults when handling DWG files from untrusted sources
• Abnormally large or malformed DWG files with suspicious compression metadata in R2004 format sections

Detection Strategies

• Implement file integrity monitoring for DWG files entering the environment to identify potentially malicious files
• Deploy application crash monitoring to detect repeated failures in LibreDWG-dependent applications
• Use memory sanitization tools (AddressSanitizer, Valgrind) in development and testing environments to identify heap overflow conditions

Monitoring Recommendations

• Monitor system logs for application crashes related to DWG file processing, particularly heap corruption or buffer overflow indicators
• Track LibreDWG library versions across the environment to maintain visibility into vulnerable deployments
• Implement file upload scanning for web applications that accept DWG files to detect potentially malicious uploads

How to Mitigate CVE-2025-61154

Immediate Actions Required

• Identify all systems and applications using LibreDWG versions v0.13.3.7571 through v0.13.3.7835
• Restrict processing of DWG files from untrusted sources until patches can be applied
• Update LibreDWG to a patched version when available from the upstream project
• Implement input validation and file sanitization for DWG files before processing

Patch Information

Users should monitor the GitHub LibreDWG Issue Tracker for updates on patches addressing this vulnerability. Additional details about the vulnerability are available at the Davisin CVE-2025-61154 Details page. It is recommended to upgrade to a version of LibreDWG newer than v0.13.3.7835 once a fix is released.

Workarounds

• Isolate DWG file processing in sandboxed environments to limit the impact of potential exploitation
• Implement strict file validation to reject DWG files that do not conform to expected specifications before passing them to LibreDWG
• Use alternative DWG parsing libraries for critical applications until a patch is available
• Disable or restrict automated DWG file processing workflows that handle files from untrusted sources

# Configuration example - Restrict DWG file processing permissions
# Limit LibreDWG execution to dedicated service account with minimal privileges
chmod 750 /path/to/libredwg-dependent-app
chown dwgservice:dwgservice /path/to/libredwg-dependent-app

# Create restricted directory for DWG file processing
mkdir -p /var/lib/dwg-processing
chmod 700 /var/lib/dwg-processing
chown dwgservice:dwgservice /var/lib/dwg-processing