CVE-2025-46397
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw was found in xfig that allows potential code execution via local input manipulation in the bezier_spline function.
Risk Assessment
An attacker with local access could exploit this vulnerability to execute arbitrary code in the context of the user running xfig, potentially leading to system compromise.
Recommendation
Update xfig to the latest version containing the security fix and restrict program access to trusted users only.
Other vulnerabilities in xfig
See all- CVE-2017-16899High
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file.
- CVE-2025-46400Medium
In the xfig diagramming tool, a segmentation fault occurs in fig2dev within the read_arcobject function, allowing an attacker to cause a denial of service via local input manipulation.
- CVE-2025-46398Medium
In the xfig diagramming tool, a stack overflow while running fig2dev allows memory corruption via local input manipulation in the read_objects function.
Original NVD description (English source)
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.