Security readout for executives and security teams
Plain-English summary
CVE-2021-36080 is a memory-management flaw in GNU LibreDWG. Affected versions can free the same memory twice while encoding DWG-related content, which may crash a process or potentially create unsafe behavior. The sources do not provide CVSS scoring or evidence of active exploitation.
Executive priority
Treat this as a targeted dependency risk, not an enterprise-wide emergency based on current evidence. Prioritize organizations that process DWG files automatically or accept CAD files from external parties.
Technical view
GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 contains a double-free in bit_chain_free, reachable from dwg_encode_MTEXT and dwg_encode_add_object. The public bundle links OSS-Fuzz/OSV tracking and a LibreDWG commit, but does not include CVSS, CWE, CPE, or exploit details.
Likely exposure
Exposure is most likely in systems using GNU LibreDWG versions 0.12.3.4163 through 0.12.3.4191, especially CAD processing tools or automation that encode DWG objects. The bundle does not identify downstream products or package ecosystems.
Exploitation context
No cited source states active exploitation, and the CVE is not marked in CISA KEV. The references indicate discovery and tracking through OSS-Fuzz/OSV, suggesting a fuzz-found memory safety issue rather than a publicly documented attack campaign.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPE, exploit status, or named fixed release appears in the supplied bundle. Analysis should stay anchored to the affected LibreDWG revision range, OSS-Fuzz/OSV issue, and the referenced upstream commit.
Mitigation direction
- Inventory systems and packages using GNU LibreDWG.
- Check whether versions fall between 0.12.3.4163 and 0.12.3.4191.
- Upgrade to a vendor-confirmed fixed LibreDWG build or release.
- Review the referenced LibreDWG commit for fix inclusion.
- Limit untrusted DWG processing until affected builds are replaced.
Validation and detection
- Confirm installed LibreDWG version or source revision.
- Verify the fix commit is present in deployed source builds.
- Review CAD processing services for LibreDWG dependency usage.
- Check crash logs for DWG encoding failures around MTEXT or object creation.
- Document any exposed workflows accepting untrusted DWG inputs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36080 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31724CVE reference · x_refsource_MISC
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-495.yamlCVE reference · x_refsource_MISC
- https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.