For GNU LibreDWG versions up to 0.14, the function read_2004_compressed_section in src/decode.c can be triggered by a maliciously crafted .dwg file, causing a heap-based buffer overflow. The overflow corrupts adjacent heap objects and can result in application crashes or denial of service. The vulnerability is identified as CWE‑119 and CWE‑122.

The impacted software is the LibreDWG Dwgread utility and any embedded C library built with versions 0.14 or earlier. Systems that process arbitrary .dwg files locally, or that allow local users to invoke the Dwgread utility, are within scope. No specific operating system or environment restrictions are indicated beyond the requirement of local file execution.

The CVSS v3.1 score of 4.8 indicates low severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access; an attacker must be able to run the Dwgread utility on the target machine and provide a crafted .dwg file. The exploit has been made public but there is no official patch yet, so the risk remains for any user or service that processes DWG files with LibreDWG.