dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwgfreeeed in free.c) because it does not properly manage the obj->eed value after a free occurs.