Skip to main content
VulnerabilityPublished Updated

dxf_entities_read · OSV-2026-995: Heap-double-free

Affects libredwgSource GCVE Database

0
Severity
Medium

Rated by Threat Radar

Patch
Available – fixed in 30f4304649433c690a62d6d0940c98a0371fda96, 5c707f7c5f748b060eb0e607f045ef617ea75e16

Data as of 7 Jul 2026, 12:28 UTC

What to do

Upgrade libredwg to 30f4304649433c690a62d6d0940c98a0371fda96 or 5c707f7c5f748b060eb0e607f045ef617ea75e16.

Affected software

ProductAffectedFixed in
OSS-Fuzzlibredwgpkg:generic/libredwgOther threatsAffected
  • >=fdf42300c049bd5b791668362873a02b5ee3ce2b <5c707f7c5f748b060eb0e607f045ef617ea75e16
  • <30f4304649433c690a62d6d0940c98a0371fda96
Fixed in
  • 5c707f7c5f748b060eb0e607f045ef617ea75e16
  • 30f4304649433c690a62d6d0940c98a0371fda96

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

If you cannot patch yet, users should consider avoiding use of the affected versions or apply any available upstream patches once released.

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528859714 ``` Crash type: Heap-double-free Crash state: dxf_entities_read dwg_read_dxf llvmfuzz.c ```

References

Community reviews

Loading reviews…