GNU libredwg up to version 0.13.4.8160 contains a heap-based buffer overflow vulnerability in the bit_read_RC function within the Dwgbmp Utility component (file bits.c). This vulnerability can be triggered remotely by crafted input, leading to memory corruption. The issue is addressed by a patch identified by commit 8f03865f37f5d4ffd616fef802acc980be54d300. The CVSS 4.0 score is 6.9, reflecting a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. Exploit code has been published, increasing the urgency of patching.

Successful exploitation of this vulnerability can lead to heap-based buffer overflow, potentially causing application crashes or arbitrary code execution. Since the attack vector is network-based and requires no privileges or user interaction, remote exploitation is feasible. The published exploit increases the likelihood of active attacks against vulnerable systems.

A patch identified by commit 8f03865f37f5d4ffd616fef802acc980be54d300 is available and should be applied to affected versions of GNU libredwg (up to 0.13.4.8160) to remediate this vulnerability. No official vendor advisory is provided, so users should verify patch applicability and test before deployment. Since this is not a cloud service, remediation depends on manual patching by users or administrators.