A heap-based buffer overflow exists in the decompress_R2004_section function of the Dwgread Utility within GNU LibreDWG up to version 0.14. The flaw arises when malformed DWG data is processed, allowing an attacker to overwrite adjacent heap memory and potentially corrupt program state. The primary weakness is a classic out‑of‑bounds write (CWE‑119) combined with a dangerous read/write of memory after allocation (CWE‑122). If successful the attacker could alter program execution, influence data integrity, or destabilize the application.

Systems running GNU LibreDWG version 0.14 or earlier are affected. The vulnerability resides in the source file src/decode.c, specifically the function decompress_R2004_section. Users of the LibreDWG Dwgread Utility without the 0.15 or later release are vulnerable.

The CVSS score of 4.8 indicates moderate impact combined with limited attack scope. EPSS is not available, and the issue is not present in CISA’s KEV catalog. The attack must be carried out locally, and exploitation code is publicly available, which raises the risk for environments that allow local attackers to run the utility. While the severity is low, the local nature of the exploit means that compromised machines could be abused to destabilize the application or corrupt data.