In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Fig2dev Project
  • Fig2dev
Redhat
  • Enterprise Linux

Configuration 1 [-]

OR cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2025-46397 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2362058 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-46397 cve-icon
https://sourceforge.net/p/mcj/tickets/192/ cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-46397 cve-icon
History

Tue, 21 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Fig2dev Project
Fig2dev Project fig2dev
CPEs cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Fig2dev Project
Fig2dev Project fig2dev

Wed, 18 Jun 2025 15:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 17 Jun 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Fri, 23 May 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 May 2025 11:45:00 +0000

Type Values Removed Values Added
Description Red Hat Product Security has come to the conclusion that this CVE is not needed. In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.
Title Xfig: fig2dev stack-overflow
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Wed, 30 Apr 2025 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Wed, 30 Apr 2025 18:15:00 +0000

Type Values Removed Values Added
Title fig2dev stack-overflow
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Apr 2025 17:30:00 +0000

Type Values Removed Values Added
Description Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function. Red Hat Product Security has come to the conclusion that this CVE is not needed.

Thu, 24 Apr 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Description Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function.
Title fig2dev stack-overflow
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2025-04-23T20:55:09.795Z

Updated: 2025-10-21T16:15:44.672Z

Reserved: 2025-04-23T20:32:36.306Z

Link: CVE-2025-46397

cve-icon Vulnrichment

Updated: 2025-04-24T13:03:56.874Z

cve-icon NVD

Status : Analyzed

Published: 2025-04-23T21:15:16.807

Modified: 2025-10-21T16:13:44.570

Link: CVE-2025-46397

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-23T20:55:09Z

Links: CVE-2025-46397 - Bugzilla