In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2025-46398 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2362055 cve-icon cve-icon
https://sourceforge.net/p/mcj/tickets/191/ cve-icon cve-icon
History

Thu, 15 May 2025 11:45:00 +0000

Type Values Removed Values Added
Description Red Hat Product Security has come to the conclusion that this CVE is not needed. In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.
Title Xfig: fig2dev stack-overflow via read_objects
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Wed, 30 Apr 2025 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Wed, 30 Apr 2025 18:15:00 +0000

Type Values Removed Values Added
Title fig2dev stack-overflow via read_objects
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Apr 2025 17:30:00 +0000

Type Values Removed Values Added
Description Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function. Red Hat Product Security has come to the conclusion that this CVE is not needed.

Thu, 24 Apr 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Description Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function.
Title fig2dev stack-overflow via read_objects
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2025-04-23T20:55:13.458Z

Updated: 2025-05-15T11:28:03.490Z

Reserved: 2025-04-23T20:32:36.307Z

Link: CVE-2025-46398

cve-icon Vulnrichment

Updated: 2025-04-24T13:03:55.479Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-04-23T21:15:16.960

Modified: 2025-05-16T14:43:56.797

Link: CVE-2025-46398

cve-icon Redhat

No data.