This vulnerability affects GNU LibreDWG versions 0.1 through 0.14 in the read_2004_compressed_section function of src/decode.c in the Dwgbmp Utility component. An out-of-bounds read can occur when processing manipulated input, potentially leading to information disclosure or application instability. Exploitation requires local access with low privileges and no user interaction. The CVSS 4.0 base score is 4.8 (medium severity), reflecting the local attack vector and limited impact. A patch commit has been identified but no explicit vendor advisory confirming patch availability is provided.

Successful exploitation of this vulnerability can cause an out-of-bounds read, which may lead to application crashes or information disclosure. The attack requires local access and low privileges, limiting the attack surface. There is no indication of remote exploitation or privilege escalation. No known exploits in the wild have been reported at this time.

A patch commit (8f03865f37f5d4ffd616fef802acc980be54d300) has been referenced to address this vulnerability. However, official patch availability or vendor advisory confirmation is not provided. It is advisable to apply the patch or upgrade to a version beyond 0.14 once an official fix is released. Until then, restrict local access to trusted users only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.