Every CVE Search/ Get API key

CVE-2025-46399

Xfig: transfig: fig2dev segmentation fault vulnerability

5.5 MediumFix available

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.25%Up 0.2 points since Apr 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.5

Xfig: transfig: fig2dev segmentation fault vulnerability

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
CVE-2025-46399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-476
Updated
2026-11-05
EUVDEUVD-2025-12158 5.5

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
EUVD-2025-12158
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-h5h2-cvc7-hm6x 7.1

Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local...

Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function.

Record
GHSA-h5h2-cvc7-hm6x
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-476
Updated
2026-11-02
NVD 5.5

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
CVE-2025-46399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-476
Updated
2026-11-05
OSVALPINE-CVE-2025-46399 5.5

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
ALPINE-CVE-2025-46399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 5.5

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
CVE-2025-46399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2025-46399 5.5

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Record
DEBIAN-CVE-2025-46399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1509 7.1

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1509
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1510 7.1

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1510
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1947 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1947
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1948 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1948
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1949 4.7

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).

Security Fix(es):

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

Record
OESA-2025-1949
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2025-0253 No score

Updated transfig packages fix security vulnerabilities

fig2dev stack-overflow. (CVE-2025-46397) fig2dev stack-overflow via read_objects. (CVE-2025-46398) fig2dev segmentation fault vulnerability. (CVE-2025-46399) fig2dev segmentation fault in read_arcobject. (CVE-2025-46400)

Record
MGASA-2025-0253
Updated
2026-11-02
OSVopenSUSE-SU-2025:15155-1 No score

transfig-3.2.9a-3.1 on GA media

These are all security issues fixed in the transfig-3.2.9a-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15155-1
Updated
2026-11-02
OSVSUSE-SU-2025:01835-1 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
  • CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
  • CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01835-1
Updated
2026-11-02
OSVSUSE-SU-2025:01835-2 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
  • CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
  • CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).
  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01835-2
Updated
2026-11-02
OSVSUSE-SU-2025:01890-1 No score

Security update for transfig

This update for transfig fixes the following issues:

Update to fig2dev version 3.2.9a

  • CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
  • CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
  • CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
  • CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).
Record
SUSE-SU-2025:01890-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fig2dev
Alpine:v3.23
 before 3.2.9a-r2
3.2.9a-r2
fig2dev
Alpine:v3.24
 before 3.2.9a-r3
3.2.9a-r3
fig2dev
Debian:12
 before 1:3.2.8b-3+deb12u2, plus listed versions
1:3.2.8b-31:3.2.8b-3+deb12u1
1:3.2.8b-3+deb12u2
fig2dev
Debian:13
 before 1:3.2.9a-4
1:3.2.9a-4
fig2dev
Debian:14
 before 1:3.2.9a-4
1:3.2.9a-4
fig2dev
Debian:11
From an advisory covering 4 CVEs
 before 1:3.2.8-3+deb11u3, plus listed versions
1:3.2.8-31:3.2.8-3+deb11u11:3.2.8-3+deb11u2
1:3.2.8-3+deb11u3
transfig
Mageia:9
From an advisory covering 4 CVEs
 before 3.2.9a-1.1.mga9
3.2.9a-1.1.mga9
transfig
openEuler:24.03-LTS
From an advisory covering 4 CVEs
 before 3.2.9-3.oe2403
3.2.9-3.oe2403
transfig
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 3.2.9-3.oe2403sp1
3.2.9-3.oe2403sp1
transfig
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2203sp4
3.2.8b-4.oe2203sp4
Show 9 moreShow less
Affected packages
PackageAffectedFixed
transfig
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2003sp4
3.2.8b-4.oe2003sp4
transfig
openEuler:22.03-LTS-SP3
From an advisory covering 4 CVEs
 before 3.2.8b-4.oe2203sp3
3.2.8b-4.oe2203sp3
transfig
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 7 CVEs
 before 3.2.9a-150600.3.5.1
3.2.9a-150600.3.5.1
transfig
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 3.2.8b-2.26.1
3.2.8b-2.26.1
transfig
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.2.9a-3.1
3.2.9a-3.1

History

History
RecordedChangedSources
affectedEUVD, NVD
factsCVE List
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46399 is a medium vulnerability (CVSS 5.5) in Fig2dev Project Fig2dev, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. Fixed in fig2dev 3.2.9a-r2.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open