CVE-2025-46397: Xfig: xfig: stack-overflow allows possible code execution via local input manipulation
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function.
Other sources
Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezierspline function.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/fig2devto a version that resolves this vulnerability.Fixed in 3.2.9a-r2 - Upgrade
Upgrade
alpine/fig2devto a version that resolves this vulnerability.Fixed in 3.2.9a-r3 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.8b-3+deb12u2 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.9a-4 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.8b-3+deb12u2Fixed in 1:3.2.9a-4Fixed in 1:3.2.9a-5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46397?
The severity of CVE-2025-46397 is critical due to the potential for code execution via stack overflow.
How do I fix CVE-2025-46397?
To fix CVE-2025-46397, users should update to the latest version of fig2dev that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2025-46397?
CVE-2025-46397 is a stack overflow vulnerability in the bezier_spline function of fig2dev.
What kind of attacks can CVE-2025-46397 enable?
CVE-2025-46397 can enable attackers to execute arbitrary code on the affected system.
Which versions of fig2dev are affected by CVE-2025-46397?
CVE-2025-46397 affects fig2dev version 3.2.9a and possibly prior versions.