← All advisories

Medium severity5.5NVD Advisory· Published Apr 23, 2025· Updated Jun 30, 2026

CVE-2025-46398

CVE-2025-46398

Description

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

14

Mcj/Xfigllm-fuzzy
osv-coords13 versions
pkg:deb/ubuntu/fig2dev@1:3.2.6a-6ubuntu1.1?arch=source&distro=esm-apps/bionic pkg:deb/ubuntu/fig2dev@1:3.2.7a-7ubuntu0.1?arch=source&distro=focal pkg:deb/ubuntu/fig2dev@1:3.2.8b-1?arch=source&distro=jammy pkg:deb/ubuntu/fig2dev@1:3.2.9-3build2?arch=source&distro=noble pkg:deb/ubuntu/fig2dev@1:3.2.9-4?arch=source&distro=oracular pkg:deb/ubuntu/fig2dev@1:3.2.9a-3?arch=source&distro=plucky pkg:rpm/opensuse/transfig&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/transfig&distro=openSUSE%20Tumbleweed pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6 pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7
>= 0+ 12 more
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: < 3.2.9a-150600.3.5.1
- (no CPE)range: < 3.2.9a-3.1
- (no CPE)range: < 3.2.9a-150600.3.5.1
- (no CPE)range: < 3.2.9a-150600.3.5.1
- (no CPE)range: < 3.2.8b-2.26.1
- (no CPE)range: < 3.2.9a-150600.3.5.1
- (no CPE)range: < 3.2.9a-150600.3.5.1

Patches

Vulnerability mechanics

References

4

sourceforge.net/p/mcj/tickets/191/nvdExploitIssue Tracking
access.redhat.com/security/cve/CVE-2025-46398nvdVendor Advisory
bugzilla.redhat.com/show_bug.cginvdVendor Advisory
lists.debian.org/debian-lts-announce/2025/04/msg00043.htmlnvd

News mentions

0

No linked articles in our index yet.