The flaw resides in the DWG_TABLE function within the Layer Encoding component of GNU libredwg file causes the function to dereference a null pointer when handling a material handle that was forcefully zeroed. The dereference results in a program crash condition for any process that parses the file. The description specifically calls this a null pointer dereference triggered by local manipulation local attacker could cause the crash.

Affected systems are those using GNU libredwg version 0.13.4 or earlier. The advisory recommends upgrading to version 0.14, which re‑introduces the guard against dereferencing a null handle. The patch (commit f5b548c4c1697d66c3dabd0f6a49280a14365a3a) was released on github and is included libredwg viewer applications, conversion tools, or scripts – should apply the update immediately.

The CVSS score of 4.8 reflects a medium severity, primarily due to the local scope of the attack vector. The EPSS score of <1% indicates a very low probability of exploitation by the general population, but the existence of a public exploit and the ability to trigger the flaw by manipulating a DWG file makes it realistic for systems that run untrusted files locally. Because the impact is denial‑of‑service rather than arbitrary code execution, the threat level is limited but still significant for environments requiring high availability. The vulnerability is not listed in the CISA KEV catalog.