The flaw lies in the dwg_next_entity function within the DWG File Handler of GNU LibreDWG, triggering a null pointer dereference when processing certain DWG files. The vulnerability is triggered by a locally crafted file; execution of the dereference leads to a crash of the affected application, effectively disrupting service. No evidence in the description indicates remote code execution, so the primary effect is a local denial of service or potential privilege‑ascending if the process runs with elevated rights.

Systems that run LibreDWG versions 0.14 or earlier are affected. The issue is present in the source file src/decode.c of the DWG File Handler component. Affected users thus include anyone who processes DWG files with an unpatched version of LibreDWG.

The CVSS score of 4.8 signifies moderate severity. EPSS data is not available, and the weakness is not listed in CISA’s KEV catalog, but the exploit code has been released publicly. Because the attack must be initiated from a local position, the risk is confined to environments where an attacker can supply a malicious DWG file to the compromised process. The vulnerability is thus a moderate local threat but remains actionable as the patch has already been published and can be applied immediately.