The vulnerability resides in the decompress_R2004_section function of the Dwgread Utility within GNU LibreDWG. When a specially crafted DWG file is processed, the function can trigger an assertion failure, which typically leads to a crash of the utility. This crash indicates a denial‑of‑service weakness and is categorized as CWE‑617 (Unchecked Return Value). The impact is confined to the process that calls Dwgread; no elevated privileges or remote code execution are required by the currently disclosed exploit.

The affected product is GNU LibreDWG, with all releases up to and including version 0.14 potentially vulnerable. The issue exists in the component src/decode.c, and a patch containing commit e501cb9926c1e9a07a0d1cc997f3e69e9be801c9 resolves the problem.

The CVSS score of 4.8 denotes moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers must have local access to the machine to supply a malicious DWG file to the Dwgread utility; the exploit is therefore limited to local scenarios. While the bug currently causes a denial of service, it does not provide remote code execution or privilege escalation. Based on the available data, the likelihood of exploitation is low but not negligible, especially in environments where LibreDWG processes untrusted documents.