Executive Summary

CVE-2025-61154 is a heap buffer overflow vulnerability found in the LibreDWG library, specifically in versions v0.13.3.7571 up to v0.13.3.7835. The flaw exists in the function decompress_R2004_section within the decode.c source file. It occurs during the decompression of R2004 compressed sections in DWG files when a specially crafted DWG file is processed.

The vulnerability causes a write operation of 1 byte beyond the allocated heap buffer boundary, leading to a segmentation fault or crash. This overflow happens because the buffer allocated via realloc in the bit_chain_alloc_size function is not large enough to safely hold the decompressed data. The issue was discovered through fuzzing and can be triggered by running the dwgread program with a malicious DWG file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause a Denial of Service (DoS) condition through a crash of the LibreDWG library when processing a malicious DWG file.

Additionally, because the heap buffer overflow may allow writing beyond allocated memory, there is a potential risk that an attacker could execute arbitrary code, leading to further compromise of the system running the vulnerable software.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by running the LibreDWG program dwgread with a specially crafted DWG file that triggers the heap buffer overflow.

Specifically, executing the command `./programs/dwgread min.dwg` where `min.dwg` is a maliciously crafted DWG file can reproduce the crash caused by the vulnerability.

The crash is typically accompanied by warnings about checksum mismatches, invalid section array sizes, and incorrect page types, which indicate corrupted or malformed input data leading to the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0