{"id":"CVE-2023-26157","aliases":["EUVD-2023-29984","GHSA-5rxp-9658-h93v","openSUSE-SU-2024:0147-1","openSUSE-SU-2024:13544-1"],"status":"published","title":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due...","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0054,"percentile":0.45903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-400"],"published":"2024-01-02T05:00:02Z","modified":"2026-10-28T10:38:33Z","fixes":[{"ecosystem":"SUSE:Package Hub 15 SP5","package":"libredwg","fixed_in":["0.12.5.6924-bp155.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libredwg","fixed_in":["0.12.5.6924-bp155.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libredwg","fixed_in":["0.12.5.6924-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5.6924-bp155.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5.6924-bp155.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5.6924-1.1"}]}]}],"products":[{"vendor":"gnu","product":"libredwg"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBREDWG-6070730","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/LibreDWG/libredwg/commit/c8cf03ce4c2315b146caf582ea061c0460193bcc","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/LibreDWG/libredwg/issues/850","tags":["x_transferred","Exploit","Issue Tracking","Patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26157","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5rxp-9658-h93v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26157.json","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WJZKASYCXFRWLMBF4XUIYV5ZN2WMSZYO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218473","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26157","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-26157","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","status":"published","published":"2024-01-02T05:00:02.461Z","modified":"2024-11-14T19:31:31.88Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-29984","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","status":"published","published":"2024-01-02T05:00:02Z","modified":"2024-11-14T19:31:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P","level":"medium"}],"updated_at":"2026-11-03T00:05:00.369745Z"}],"ghsa":[{"id":"GHSA-5rxp-9658-h93v","title":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due...","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","status":"published","published":"2024-01-02T06:30:30Z","modified":"2024-01-08T21:30:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-400"],"updated_at":"2026-11-02T14:55:21.919096Z"}],"nvd":[{"id":"CVE-2023-26157","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","status":"published","published":"2024-01-02T05:15:08.16Z","modified":"2026-06-17T05:42:48.403Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-125"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-26157","description":"Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section-\u003enum_pages in decode_r2007.c.","status":"published","published":"2024-01-02T05:00:02.461Z","modified":"2026-10-28T10:38:33.539859784Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"openSUSE-SU-2024:0147-1","title":"Security update for libredwg","description":"This update for libredwg fixes the following issues:\n\nUpdate to tag 0.12.5.6924:\n\n- CVE-2023-26157: Fixed out-of-bound read involving section-\u003enum_pages in decode_r2007.c (boo#1218473)\n","status":"published","published":"2024-05-29T16:41:07Z","modified":"2026-02-04T02:30:08.21626Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13544-1","title":"libredwg-devel-0.12.5.6924-1.1 on GA media","description":"These are all security issues fixed in the libredwg-devel-0.12.5.6924-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:39.994935Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}