CVE-2025-46399

Xfig: transfig: fig2dev segmentation fault vulnerability

Published Apr 23, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Analysis

No analysis available yet

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.2.9a

Red Hat Red Hat Enterprise Linux 6 affected —

Red Hat Red Hat Enterprise Linux 7 affected —

Red Hat Red Hat Enterprise Linux 8 affected —

Red Hat Red Hat Enterprise Linux 9 affected —

Configuration 1 [-]

cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

No data.

No data available yet.

Remediation

No remediation available yet

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4147-1	fig2dev security update
EUVD	EUVD-2025-12158	A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.246% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-46399
https://bugzilla.redhat.com/show_bug.cgi?id=2362053
https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html
https://nvd.nist.gov/vuln/detail/CVE-2025-46399
https://sourceforge.net/p/mcj/tickets/190/
https://www.cve.org/CVERecord?id=CVE-2025-46399

History

Nov 5, 2026 4:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9	cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7
Vendors & Products		Redhat rhel Els

Jun 30, 2026 4:30 AM Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/o:redhat:rhivos:1~~
Vendors & Products	Redhat rhivos

Jun 25, 2026 5:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhivos
CPEs		cpe:/o:redhat:rhivos:1
Vendors & Products		Redhat rhivos

Jan 8, 2026 3:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}`

Nov 3, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html

Oct 16, 2025 9:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fig2dev Project Fig2dev Project fig2dev
CPEs		cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:::::::* cpe:2.3:o:redhat:enterprise_linux:6.0:::::::* cpe:2.3:o:redhat:enterprise_linux:7.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
Vendors & Products		Fig2dev Project Fig2dev Project fig2dev

Jun 24, 2025 1:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Xfig: fig2dev segmentation fault vulnerability	Xfig: transfig: fig2dev segmentation fault vulnerability

Jun 18, 2025 3:00 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2025-46399 https://www.cve.org/CVERecord?id=CVE-2025-46399
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 17, 2025 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
Description	In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.	A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.
Title	Xfig: fig2dev segmentation fault in genge_itp_spline	Xfig: fig2dev segmentation fault vulnerability
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

May 23, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 15, 2025 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Red Hat Product Security has come to the conclusion that this CVE is not needed.	In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.
Title		Xfig: fig2dev segmentation fault in genge_itp_spline
Weaknesses		CWE-476
References		https://access.redhat.com/security/cve/CVE-2025-46399 https://bugzilla.redhat.com/show_bug.cgi?id=2362053 https://sourceforge.net/p/mcj/tickets/190/
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Apr 30, 2025 6:45 PM Weaknesses updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-476
References	https://sourceforge.net/p/mcj/tickets/190/
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

Apr 30, 2025 6:15 PM Title updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	fig2dev segmentation fault in genge_itp_spline
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 30, 2025 5:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function.	Red Hat Product Security has come to the conclusion that this CVE is not needed.

Apr 24, 2025 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 23, 2025 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function.
Title		fig2dev segmentation fault in genge_itp_spline
Weaknesses		CWE-476
References		https://sourceforge.net/p/mcj/tickets/190/
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`