CVE-2025-46400: Xfig: fig2dev segmentation fault in read_arcobject
In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function.
Other sources
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via readarcobject function.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/fig2devto a version that resolves this vulnerability.Fixed in 3.2.9a-r2 - Upgrade
Upgrade
alpine/fig2devto a version that resolves this vulnerability.Fixed in 3.2.9a-r3 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.8b-3+deb12u2 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.9a-3 - Upgrade
Upgrade
debian/fig2devto a version that resolves this vulnerability.Fixed in 1:3.2.8b-3+deb12u2Fixed in 1:3.2.9a-4Fixed in 1:3.2.9a-5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46400?
CVE-2025-46400 is considered a high severity vulnerability due to its potential to cause a segmentation fault and compromise system availability.
How do I fix CVE-2025-46400?
To fix CVE-2025-46400, it is recommended to update to the latest version of fig2dev that addresses this vulnerability.
What software is affected by CVE-2025-46400?
CVE-2025-46400 affects the fig2dev software, specifically version 3.2.9a.
What type of vulnerability is CVE-2025-46400?
CVE-2025-46400 is a segmentation fault vulnerability that can lead to denial of service when exploited.
Can CVE-2025-46400 be exploited locally?
Yes, CVE-2025-46400 can be exploited via local input manipulation, making it accessible to local users.