CVE-2025-46399 - Vulnerability Details

- Xfig: transfig: fig2dev segmentation fault vulnerability

Description

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

Published: 2025-04-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.2.9a

Red Hat Red Hat Enterprise Linux 6 affected —

Red Hat Red Hat Enterprise Linux 7 affected —

Red Hat Red Hat Enterprise Linux 8 affected —

Red Hat Red Hat Enterprise Linux 9 affected —

Configuration 1 [-]

cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4147-1	fig2dev security update
EUVD	EUVD-2025-12158	A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00142.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-46399
https://bugzilla.redhat.com/show_bug.cgi?id=2362053
https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html
https://nvd.nist.gov/vuln/detail/CVE-2025-46399
https://sourceforge.net/p/mcj/tickets/190/
https://www.cve.org/CVERecord?id=CVE-2025-46399

History

Thu, 08 Jan 2026 03:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}`

Mon, 03 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html

Thu, 16 Oct 2025 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fig2dev Project Fig2dev Project fig2dev
CPEs		cpe:2.3:a:fig2dev_project:fig2dev:3.2.9a:::::::* cpe:2.3:o:redhat:enterprise_linux:6.0:::::::* cpe:2.3:o:redhat:enterprise_linux:7.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
Vendors & Products		Fig2dev Project Fig2dev Project fig2dev

Tue, 24 Jun 2025 13:15:00 +0000

Type	Values Removed	Values Added
Title	Xfig: fig2dev segmentation fault vulnerability	Xfig: transfig: fig2dev segmentation fault vulnerability

Wed, 18 Jun 2025 15:00:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2025-46399 https://www.cve.org/CVERecord?id=CVE-2025-46399
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 17 Jun 2025 15:30:00 +0000

Type	Values Removed	Values Added
Description	In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.	A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.
Title	Xfig: fig2dev segmentation fault in genge_itp_spline	Xfig: fig2dev segmentation fault vulnerability
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Fri, 23 May 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 May 2025 17:00:00 +0000

Type	Values Removed	Values Added
Description	Red Hat Product Security has come to the conclusion that this CVE is not needed.	In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.
Title		Xfig: fig2dev segmentation fault in genge_itp_spline
Weaknesses		CWE-476
References		https://access.redhat.com/security/cve/CVE-2025-46399 https://bugzilla.redhat.com/show_bug.cgi?id=2362053 https://sourceforge.net/p/mcj/tickets/190/
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Wed, 30 Apr 2025 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476
References	https://sourceforge.net/p/mcj/tickets/190/
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

Wed, 30 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Title	fig2dev segmentation fault in genge_itp_spline
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 30 Apr 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description	Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function.	Red Hat Product Security has come to the conclusion that this CVE is not needed.

Thu, 24 Apr 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 23 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Description		Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function.
Title		fig2dev segmentation fault in genge_itp_spline
Weaknesses		CWE-476
References		https://sourceforge.net/p/mcj/tickets/190/
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

Subscriptions

Fig2dev Project Fig2dev

Redhat Enterprise Linux

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2025-04-23T20:55:15.407Z

Updated: 2026-01-08T03:04:07.807Z

Reserved: 2025-04-23T20:32:36.307Z

Link: CVE-2025-46399

Vulnrichment

Updated: 2025-11-03T20:04:29.942Z

NVD

Status : Modified

Published: 2025-04-23T21:15:17.110

Modified: 2026-01-08T04:15:53.663

Link: CVE-2025-46399

Redhat

Severity : Moderate

Publid Date: 2025-04-23T20:55:15Z

Links: CVE-2025-46399 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-476

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object