A heap-based out-of-bounds write occurs in the bundled libdxfrw `dwgReader18::parseDataPage()` function because buffer size and page offsets are not checked. An attacker can use a specially crafted AC1018 (R2004) DWG file with malicious `startOffset` values to trigger the `decompress18` function to write past the heap buffer upon opening the file, leading to application crashes or potential arbitrary code execution.