GNU LibreDWG Null Pointer Dereference Vulnerability in DWG File Handler

A null pointer dereference vulnerability has been identified in GNU LibreDWG versions through 0.14. The issue arises in the DWG File Handler component, specifically within the 'dwg_next_entity' function of 'src/decode.c'. This vulnerability allows for a local attack that can lead to a segmentation fault by accessing an invalid memory address. The flaw has been publicly disclosed and exploited.

Impact

Exploitation of this vulnerability causes a segmentation fault due to a null pointer dereference, leading to a crash of the application.

Reproduction

The vulnerability can be reproduced by using the 'dwg2SVG' tool included with LibreDWG. After compiling LibreDWG with AddressSanitizer enabled, a malformed DWG file that triggers the null pointer dereference can be processed with 'dwg2SVG', resulting in a crash.

Remediation

Users are advised to upgrade to the patched version of GNU LibreDWG, which is available in the official repository.