Every CVE Search/ Get API key

CVE-2025-46397

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

7.8 HighFix available

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.30%Up 0.3 points since Apr 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.8

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
CVE-2025-46397
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-05
EUVDEUVD-2025-12159 7.8

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
EUVD-2025-12159
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-fqm9-qqwf-gq9r 7.1

Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local...

Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function.

Record
GHSA-fqm9-qqwf-gq9r
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-120, CWE-121
Updated
2026-11-02
NVD 7.8

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
CVE-2025-46397
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-05
OSVALPINE-CVE-2025-46397 7.8

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
ALPINE-CVE-2025-46397
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
CVE-2025-46397
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 19 moreShow less
OSVDEBIAN-CVE-2025-46397 7.8

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

Record
DEBIAN-CVE-2025-46397
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1509 7.1

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1509
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1510 7.1

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1510
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1947 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1947
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1948 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1948
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1949 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1949
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:0700 7.8

Red Hat Security Advisory: transfig security update

Record
RHSA-2026:0700
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0704 7.8

Red Hat Security Advisory: transfig security update

Record
RHSA-2026:0704
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0705 7.8

Red Hat Security Advisory: transfig security update

Record
RHSA-2026:0705
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0756 7.8

Red Hat Security Advisory: transfig security update

Record
RHSA-2026:0756
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:0700 7.8

Moderate: transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.

Security Fix(es):

  • xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:0700
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:0756 7.8

Moderate: transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.

Security Fix(es):

  • xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:0756
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:0700 No score

Moderate: transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.

Security Fix(es):

  • xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:0700
Updated
2026-11-02
OSVALSA-2026:0756 No score

Moderate: transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.

Security Fix(es):

  • xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:0756
Updated
2026-11-02
OSVMGASA-2025-0253 No score

Updated transfig packages fix security vulnerabilities

fig2dev stack-overflow. (CVE-2025-46397) fig2dev stack-overflow via read_objects. (CVE-2025-46398) fig2dev segmentation fault vulnerability. (CVE-2025-46399) fig2dev segmentation fault in read_arcobject. (CVE-2025-46400)

Record
MGASA-2025-0253
Updated
2026-11-02
OSVopenSUSE-SU-2025:15155-1 No score

transfig-3.2.9a-3.1 on GA media

These are all security issues fixed in the transfig-3.2.9a-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15155-1
Updated
2026-11-02
OSVSUSE-SU-2025:01835-1 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
  • CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
  • CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01835-1
Updated
2026-11-02
OSVSUSE-SU-2025:01835-2 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
  • CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
  • CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01835-2
Updated
2026-11-02
OSVSUSE-SU-2025:01890-1 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01890-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fig2dev
Alpine:v3.23
 before 3.2.9a-r2
3.2.9a-r2
fig2dev
Alpine:v3.24
 before 3.2.9a-r3
3.2.9a-r3
transfig
AlmaLinux:9
 before 1:3.2.7b-11.el9_7
1:3.2.7b-11.el9_7
transfig
AlmaLinux:8
 before 1:3.2.6a-5.el8_10
1:3.2.6a-5.el8_10
fig2dev
Debian:12
 before 1:3.2.8b-3+deb12u2, plus listed versions
1:3.2.8b-31:3.2.8b-3+deb12u1
1:3.2.8b-3+deb12u2
fig2dev
Debian:13
 before 1:3.2.9a-4
1:3.2.9a-4
fig2dev
Debian:14
 before 1:3.2.9a-4
1:3.2.9a-4
fig2dev
Debian:11
From an advisory covering 4 CVEs
 before 1:3.2.8-3+deb11u3, plus listed versions
1:3.2.8-31:3.2.8-3+deb11u11:3.2.8-3+deb11u2
1:3.2.8-3+deb11u3
transfig
Mageia:9
From an advisory covering 4 CVEs
 before 3.2.9a-1.1.mga9
3.2.9a-1.1.mga9
transfig
openEuler:24.03-LTS
From an advisory covering 4 CVEs
 before 3.2.9-3.oe2403
3.2.9-3.oe2403
Show 25 moreShow less
Affected packages
PackageAffectedFixed
transfig
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 3.2.9-3.oe2403sp1
3.2.9-3.oe2403sp1
transfig
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2203sp4
3.2.8b-4.oe2203sp4
transfig
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2003sp4
3.2.8b-4.oe2003sp4
transfig
openEuler:22.03-LTS-SP3
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2203sp3
3.2.8b-4.oe2203sp3
transfig
Red Hat:enterprise_linux:9::crb
 before 1:3.2.7b-11.el9_7
1:3.2.7b-11.el9_7
transfig-debuginfo
Red Hat:enterprise_linux:9::crb
 before 1:3.2.7b-11.el9_7
1:3.2.7b-11.el9_7
transfig-debugsource
Red Hat:enterprise_linux:9::crb
 before 1:3.2.7b-11.el9_7
1:3.2.7b-11.el9_7
transfig
Red Hat:rhel_eus:9.6::crb
 before 1:3.2.7b-10.el9_6.1
1:3.2.7b-10.el9_6.1
transfig-debuginfo
Red Hat:rhel_eus:9.6::crb
 before 1:3.2.7b-10.el9_6.1
1:3.2.7b-10.el9_6.1
transfig-debugsource
Red Hat:rhel_eus:9.6::crb
 before 1:3.2.7b-10.el9_6.1
1:3.2.7b-10.el9_6.1
transfig
Red Hat:rhel_eus:9.4::crb
 before 1:3.2.7b-10.el9_4.1
1:3.2.7b-10.el9_4.1
transfig-debuginfo
Red Hat:rhel_eus:9.4::crb
 before 1:3.2.7b-10.el9_4.1
1:3.2.7b-10.el9_4.1
transfig-debugsource
Red Hat:rhel_eus:9.4::crb
 before 1:3.2.7b-10.el9_4.1
1:3.2.7b-10.el9_4.1
transfig
Red Hat:enterprise_linux:8::crb
 before 1:3.2.6a-5.el8_10
1:3.2.6a-5.el8_10
transfig-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:3.2.6a-5.el8_10
1:3.2.6a-5.el8_10
transfig-debugsource
Red Hat:enterprise_linux:8::crb
 before 1:3.2.6a-5.el8_10
1:3.2.6a-5.el8_10
transfig
Rocky Linux:9
 before 1:3.2.7b-11.el9_7
1:3.2.7b-11.el9_7
transfig
Rocky Linux:8
 before 1:3.2.6a-5.el8_10
1:3.2.6a-5.el8_10
transfig
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 3.2.8b-2.26.1
3.2.8b-2.26.1
transfig
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.2.9a-3.1
3.2.9a-3.1

History

History
RecordedChangedSources
affectedEUVD, NVD
factsCVE List
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46397 is a high vulnerability (CVSS 7.8) in Fig2dev Project Fig2dev, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in fig2dev 3.2.9a-r2.

References

Show 48 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open