CVE-2025-31164
fig2dev heap-buffer overflow
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
fig2dev heap-buffer overflow
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2025-8632
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
EUVD-2025-8632- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p47h-x29h-rvvm
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local...
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
GHSA-p47h-x29h-rvvm- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-31164
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
ALPINE-CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-03
OSV
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2025-31164
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
DEBIAN-CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2025-1366
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.(CVE-2025-31162)
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.(CVE-2025-31163)
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.(CVE-2025-31164)
- Record
OESA-2025-1366- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2025-1367
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.(CVE-2025-31162)
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.(CVE-2025-31163)
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.(CVE-2025-31164)
- Record
OESA-2025-1367- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2025-1368
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.(CVE-2025-31162)
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.(CVE-2025-31163)
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.(CVE-2025-31164)
- Record
OESA-2025-1368- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2025-1406
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.(CVE-2025-31162)
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.(CVE-2025-31163)
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.(CVE-2025-31164)
- Record
OESA-2025-1406- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2025-1407
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.(CVE-2025-31162)
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.(CVE-2025-31163)
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.(CVE-2025-31164)
- Record
OESA-2025-1407- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-31164
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline.
- Record
UBUNTU-CVE-2025-31164- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVMGASA-2025-0152 No score
Updated transfig packages fix security vulnerabilities
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function. (CVE-2025-31162) Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function. (CVE-2025-31163) Heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline. (CVE-2025-31164)
- Record
MGASA-2025-0152- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15064-1 No score
transfig-3.2.9a-2.1 on GA media
These are all security issues fixed in the transfig-3.2.9a-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15064-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01835-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Update to fig2dev version 3.2.9a
- CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
- CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
- CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
- CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
- CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
- CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
- CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
- Record
SUSE-SU-2025:01835-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01835-2 No score
Security update for transfig
This update for transfig fixes the following issues:
Update to fig2dev version 3.2.9a
- CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
- CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
- CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
- CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
- CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
- CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
- CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
- Record
SUSE-SU-2025:01835-2- Updated
- 2026-11-02
OSVSUSE-SU-2025:1540-1 No score
Security update for transfig
This update for transfig fixes the following issues:
- CVE-2025-31164: Fixed heap-buffer overflow in fig2dev create_line_with_spline() function (bsc#1240379)
- CVE-2025-31162: Fixed floating point exception in fig2dev get_slope() function (bsc#1240380)
- CVE-2025-31163: Fixed segmentation fault in fig2dev put_patternarc() function (bsc#1240381)
- Record
SUSE-SU-2025:1540-1- Updated
- 2026-11-02
OSVUSN-7587-1 No score
fig2dev vulnerabilities
Suhwan Song discovered that Fig2dev did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-21680, CVE-2020-21682, CVE-2020-21683)
It was discovered that Fig2dev did not limit the size of certain inputs. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2025-31162, CVE-2025-31163)
It was discovered that Fig2dev did not correctly handle certain inputs. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-31164)
- Record
USN-7587-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fig2devAlpine:v3.23 |
before 3.2.9a-r2 | 3.2.9a-r2 |
fig2devAlpine:v3.24 |
before 3.2.9a-r2 | 3.2.9a-r2 |
fig2devDebian:12 |
before 1:3.2.8b-3+deb12u1, plus listed versions 1:3.2.8b-3 |
1:3.2.8b-3+deb12u1 |
fig2devDebian:13 |
before 1:3.2.9a-2 | 1:3.2.9a-2 |
fig2devDebian:14 |
before 1:3.2.9a-2 | 1:3.2.9a-2 |
fig2devDebian:11 From an advisory covering 3 CVEs |
before 1:3.2.8-3+deb11u2, plus listed versions 1:3.2.8-31:3.2.8-3+deb11u1 |
1:3.2.8-3+deb11u2 |
transfigMageia:9 From an advisory covering 3 CVEs |
before 3.2.9a-1.mga9 | 3.2.9a-1.mga9 |
transfigopenEuler:22.03-LTS-SP3 From an advisory covering 3 CVEs |
before 3.2.8b-3.oe2203sp3 | 3.2.8b-3.oe2203sp3 |
transfigopenEuler:24.03-LTS From an advisory covering 3 CVEs |
before 3.2.9-2.oe2403 | 3.2.9-2.oe2403 |
transfigopenEuler:24.03-LTS-SP1 From an advisory covering 3 CVEs |
before 3.2.9-2.oe2403sp1 | 3.2.9-2.oe2403sp1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
transfigopenEuler:22.03-LTS-SP4 From an advisory covering 3 CVEs |
before 3.2.8b-3.oe2203sp4 | 3.2.8b-3.oe2203sp4 |
transfigopenEuler:20.03-LTS-SP4 From an advisory covering 3 CVEs |
before 3.2.8b-3.oe2003sp4 | 3.2.8b-3.oe2003sp4 |
transfigSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 7 CVEs |
before 3.2.9a-150600.3.5.1 | 3.2.9a-150600.3.5.1 |
transfigSUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 7 CVEs |
before 3.2.9a-150600.3.5.1 | 3.2.9a-150600.3.5.1 |
transfigopenSUSE:Leap 15.6 From an advisory covering 7 CVEs |
before 3.2.9a-150600.3.5.1 | 3.2.9a-150600.3.5.1 |
transfigSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 7 CVEs |
before 3.2.9a-150600.3.5.1 | 3.2.9a-150600.3.5.1 |
transfigSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 7 CVEs |
before 3.2.9a-150600.3.5.1 | 3.2.9a-150600.3.5.1 |
transfigSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 3 CVEs |
before 3.2.8b-2.23.1 | 3.2.8b-2.23.1 |
fig2devUbuntu:Pro:24.04:LTS |
before 1:3.2.9-3ubuntu0.1~esm1, plus listed versions 1:3.2.8b-31:3.2.9-31:3.2.9-3build11:3.2.9-3build2 |
1:3.2.9-3ubuntu0.1~esm1 |
fig2devUbuntu:Pro:18.04:LTS From an advisory covering 6 CVEs |
before 1:3.2.6a-6ubuntu1.1+esm1, plus listed versions 1:3.2.6a-31:3.2.6a-41:3.2.6a-4ubuntu11:3.2.6a-6ubuntu11:3.2.6a-6ubuntu1.1 |
1:3.2.6a-6ubuntu1.1+esm1 |
fig2devUbuntu:Pro:20.04:LTS From an advisory covering 6 CVEs |
before 1:3.2.7a-7ubuntu0.1+esm1, plus listed versions 1:3.2.7a-71:3.2.7a-7ubuntu0.1 |
1:3.2.7a-7ubuntu0.1+esm1 |
fig2devUbuntu:Pro:22.04:LTS From an advisory covering 6 CVEs |
before 1:3.2.8b-1ubuntu0.1~esm1, plus listed versions 1:3.2.8-31:3.2.8b-1 |
1:3.2.8b-1ubuntu0.1~esm1 |
fig2devUbuntu:Pro:24.04:LTS From an advisory covering 6 CVEs |
before 1:3.2.9-3ubuntu0.1~esm1, plus listed versions 1:3.2.8b-31:3.2.9-31:3.2.9-3build11:3.2.9-3build2 |
1:3.2.9-3ubuntu0.1~esm1 |
transfigopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.2.9a-2.1 | 3.2.9a-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31164 is a medium vulnerability (CVSS 6.6) in Fig2dev Project Fig2dev, published March 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in fig2dev 3.2.9a-r2.
References
sourceforge.net/p/mcj/tickets/184
lists.debian.org/debian-lts-announce/2025/04/msg00030.html
nvd.nist.gov/vuln/detail/CVE-2025-31164
github.com/advisories/GHSA-p47h-x29h-rvvm
security.alpinelinux.org/vuln/CVE-2025-31164
security-tracker.debian.org/tracker/CVE-2025-31164
Show 38 moreShow less
advisories.mageia.org/MGASA-2025-0152.html
bugs.mageia.org/show_bug.cgi?id=34260
lists.opensuse.org/archives/list/[email protected]/message/MJCOBXBMU3EIKTUVVEJUQTIAIJY6GWXG
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1366
suse.com/support/update/announcement/2025/suse-su-202501835-1
bugzilla.suse.com/1225947
ubuntu.com/security/CVE-2025-31164
cve.org/CVERecord?id=CVE-2025-31164