Lee Keon-Hyeong

A heap-based out-of-bounds write occurs in the bundled libdxfrw `dwgReader18::parseDataPage()` function because buffer size and page offsets are not checked. An attacker can use a specially crafted AC1018 (R2004) DWG file with malicious `startOffset` values to trigger the `decompress18` function to write past the heap buffer upon opening the file, leading to application crashes or potential arbitrary code execution.

When built with `USE HTTP2` and `enable http2` enabled, the software contains a use-after-free issue in the `handle http2()` function. This occurs because the system retains freed `:method` and `:path` pointers. An unauthenticated remote attacker can send a subsequent HEADERS frame that omits these pseudo-headers to manipulate the request method or path evaluated by access rules, or cause the server to crash. A use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed, potentially leading to arbitrary code execution or system instability.