The vulnerability is a null pointer dereference in the dwg_next_entity function, corresponding to CWE‑476 (Null Pointer Dereference) and CWE‑404 (Missing Resource Release). When a malicious DWG file passes an unexpected null or improperly formed next_obj argument, the library dereferences a null pointer, resulting in an illegal memory access that crashes the application using LibreDWG, thereby causing a denial‑of‑service.

GNU LibreDWG versions up to 0.13.4 are affected. The library, produced by the GNU project, is used in applications that parse DWG files. Any system running LibreDWG 0.13.4 or earlier may be vulnerable when processing a crafted DWG file.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score of < 1% signifies that the likelihood of real‑world exploitation is very low. The flaw is not listed in the CISA KEV catalog. Attack must originate from a local position; an attacker can supply a malicious DWG file to an application that uses LibreDWG, causing it to crash. Although the risk to remote adversaries is minimal, the publicly known exploit and the potential for service disruption make timely remediation advisable.