CVE-2021-36080: 
NixOS vulnerability analysis and mitigation

GNU LibreDWG versions 0.12.3.4163 through 0.12.3.4191 contains a double-free vulnerability in the bitchainfree function, which is called from dwgencodeMTEXT and dwgencodeadd_object functions. The vulnerability was discovered on March 6, 2021, and was fixed in a subsequent update (OSS-Fuzz Report).

The vulnerability is a heap-based double-free issue that occurs in the bitchainfree function when it's called from dwgencodeMTEXT and dwgencodeaddobject. The issue arises in cases of handle overflow, such as numreactors, where the same memory location is freed twice (LibreDWG Commit).

A heap double-free vulnerability can lead to memory corruption, which could potentially result in program crashes or arbitrary code execution. The severity of this vulnerability has been rated as HIGH according to the ecosystem-specific assessment (OSS-Fuzz Vulns).

The vulnerability was fixed in a commit (9b6e0ff9ef02818df034fc42c3bd149a5ff89342) that modified the handle data management to avoid the double-free condition. Users should upgrade to a version after 0.12.3.4191 to receive the fix (LibreDWG Commit).