CVE-2025-46400
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the xfig diagramming tool, a segmentation fault occurs in fig2dev within the read_arcobject function, allowing an attacker to cause a denial of service via local input manipulation.
Risk Assessment
An attacker with local access can craft malicious input to crash fig2dev, disrupting the tool's availability for legitimate users.
Recommendation
Update xfig to the latest version containing the fix for CVE-2025-46400 and restrict trusted input sources for fig2dev.
Other vulnerabilities in xfig
See all- CVE-2017-16899High
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file.
- CVE-2025-46398Medium
In the xfig diagramming tool, a stack overflow while running fig2dev allows memory corruption via local input manipulation in the read_objects function.
- CVE-2025-46397High
A flaw was found in xfig that allows potential code execution via local input manipulation in the bezier_spline function.
Original NVD description (English source)
In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS