CVE-2021-36080: 
NixOS vulnerability analysis and mitigation

GNU LibreDWG versions 0.12.3.4163 through 0.12.3.4191 contains a double-free vulnerability in the bit_chain_free function, which is called from dwg_encode_MTEXT and dwg_encode_add_object functions. The vulnerability was discovered on March 6, 2021, and was fixed in a subsequent update (OSS-Fuzz Report).

The vulnerability is a heap-based double-free issue that occurs in the bit_chain_free function when it's called from dwg_encode_MTEXT and dwg_encode_add_object. The issue arises in cases of handle overflow, such as num_reactors, where the same memory location is freed twice (LibreDWG Commit).

A heap double-free vulnerability can lead to memory corruption, which could potentially result in program crashes or arbitrary code execution. The severity of this vulnerability has been rated as HIGH according to the ecosystem-specific assessment (OSS-Fuzz Vulns).

The vulnerability can be triggered through specially crafted input that causes a handle overflow condition. The issue was discovered through automated fuzzing by OSS-Fuzz, suggesting it could be exploited through malformed input files (OSS-Fuzz Report).

The vulnerability was fixed in a commit (9b6e0ff9ef02818df034fc42c3bd149a5ff89342) that modified the handle data management to avoid the double-free condition. Users should upgrade to a version after 0.12.3.4191 to receive the fix (LibreDWG Commit).