A heap buffer overflow occurs in the function decompress_R2004_section in decode.c when parsing a crafted DWG file. The overflow enables an attacker to force the LibreDWG library to crash, resulting in a denial of service. The vulnerability is a classic example of an out‑of‑bounds write (CWE‑122).

LibreDWG versions 0.13.3.7571 through 0.13.3.7835 are affected. Any system that uses these releases to read or process DWG files is potentially vulnerable.

The CVSS score is 6.5, indicating moderate severity. EPSS is below 1 %, indicating a low probability of exploitation in production. The vulnerability is not listed in the CISA KEV catalog. The attack vector is file‑based; an adversary can deliver a malicious DWG file to a user of the affected LibreDWG version to trigger the crash. Although the likelihood of widespread exploitation is low, the impact on availability makes patching advisable.