{"id":"CVE-2021-36080","details":"GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit_chain_free (called from dwg_encode_MTEXT and dwg_encode_add_object).","modified":"2026-07-09T01:07:04.585496Z","published":"2021-07-01T03:15:08.573Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.12.3.4163"},{"last_affected":"0.12.3.4191"}],"source":"CPE_RANGE","vendor_product":"gnu:libredwg"},{"extracted_events":[{"introduced":"0.12.3.4163"},{"fixed":"0.12.3.4191"}],"source":"DESCRIPTION"}]},"references":[{"type":"ADVISORY","url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-495.yaml"},{"type":"FIX","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31724"},{"type":"FIX","url":"https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libredwg/libredwg","events":[{"introduced":"0"},{"fixed":"9b6e0ff9ef02818df034fc42c3bd149a5ff89342"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.12.3","0.12.2","0.12.1","0.12","0.11.1","0.11","0.10.1","0.10","0.9.3","0.9.2","0.9.1","0.9","0.8","0.7","0.6.2","0.6.1","0.6","0.5","0.4.938","0.4.924","0.4.900","0.4-dev","0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36080.json","vanir_signatures_modified":"2026-07-09T01:07:04Z","vanir_signatures":[{"digest":{"function_hash":"117940919438387030657313444888900934789","length":440},"id":"CVE-2021-36080-411c8eff","signature_type":"Function","signature_version":"v1","source":"https://github.com/libredwg/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342","target":{"file":"src/encode.c","function":"_private"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"222482997438391403955362237316737849451","length":480},"id":"CVE-2021-36080-7d2cda6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/libredwg/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342","target":{"function":"token","file":"src/encode.c"}},{"deprecated":false,"digest":{"function_hash":"56926433449165778975677005811349847944","length":480},"id":"CVE-2021-36080-d6311943","signature_type":"Function","signature_version":"v1","source":"https://github.com/libredwg/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342","target":{"function":"token","file":"src/encode.c"}},{"deprecated":false,"digest":{"line_hashes":["288712488893903512223280823526857305454","85455761272098550183880599787532100014","183069802358250971376645517424090144774","47284913634765236378214009821009347064","2340223854611400523904418016634482337","56912377388653730600853018597790924986","89014135500226548444945712381399167817","287660253048912785076616423617966800388","69451097223397141196608426186242963027","62910346436502076506951609763194359802","239957100592431877625630349834377995956","220703862567639174924490715496829136588","34066312719592156980629263546744633452","100509082883586296856352783302746544168","69782854348130418566692199746206054914","285616631961413851070736294433384921611","233567386203093787833446618422777771967","235481404105748525695745805176382772360","18423438818818081493221269029834857545","118256802939868015571075378876605315506","44762612608796111107454217659073804633","334336627696390824614795281904961646396","326898558449254293948635311760065653585","279054814108048591727434534025067945793","258455768917598868792004258236289458496","334950678624749253510238704511738057616","146380922260753864319318518045047523014","274171806876113715787150586942507807517","70409827101518024311426649938334070516","22804330745980459824173796120022781770","312758586359002173452077683048822947042","234887475365151299811247877605884526405","336433176821158571678543261548574020538","215105040095945958114233462225310459647","100509082883586296856352783302746544168","285616631961413851070736294433384921611","233567386203093787833446618422777771967","235481404105748525695745805176382772360","18423438818818081493221269029834857545","234887475365151299811247877605884526405","336433176821158571678543261548574020538","215105040095945958114233462225310459647","100509082883586296856352783302746544168"],"threshold":0.9},"id":"CVE-2021-36080-debc5567","signature_type":"Line","signature_version":"v1","source":"https://github.com/libredwg/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342","target":{"file":"src/encode.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libredwg/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342","target":{"file":"src/encode.c","function":"_private"},"deprecated":false,"digest":{"function_hash":"324569338775683358868175276696415478172","length":404},"id":"CVE-2021-36080-ea907bf6"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}