An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.

A NULL pointer dereference vulnerability was found in graphviz in the rebuildvlists function. A maliciously crafted file could cause the application to crash.

References:

https://issuetracker.google.com/issues/77810342

Upstream issue:

https://gitlab.com/graphviz/graphviz/issues/1367