Xfig: fig2dev segmentation fault in read_arcobject

Vulnerability

The vulnerability exists in the read_arcobject function in read1_3.c of fig2dev, part of the xfig diagramming tool. In version 3.2.9a (and possibly earlier), processing a specially crafted FIG file results in a conditional jump depending on an uninitialised value, leading to a segmentation fault [1][2]. The affected code path is reachable when fig2dev parses arc objects from FIG input files.

Exploitation

An attacker with local system access can trigger the vulnerability by supplying a malicious FIG file to fig2dev. No authentication or elevated privileges are required. For example, running fig2dev -L pict2e ./poc with a crafted file causes the segmentation fault, as demonstrated by valgrind output showing uninitialised value usage in read_arcobject [2].

Impact

Successful exploitation causes fig2dev to crash via a segmentation fault, resulting in a denial of service (availability impact) for the user attempting to convert the FIG file. No evidence of code execution or information disclosure exists [1].

Mitigation

As of the publication date (2025-04-23), no fix has been released for version 3.2.9a. Users should avoid processing untrusted FIG files with fig2dev. Monitor for updates from the xfig project on SourceForge [2]; if a patch becomes available, upgrade immediately. The CVE is not listed in CISA KEV [3].