CVE-2025-46397: Fig2dev RCE Vulnerability via Bezier

CVE-2025-46397 Overview

A buffer overflow vulnerability has been identified in xfig/fig2dev, a utility for converting FIG format files to various output formats. The flaw resides in the bezier_spline function and allows possible code execution via local input manipulation. An attacker with local access could craft malicious input to exploit this vulnerability, potentially gaining arbitrary code execution with the privileges of the user running the affected application.

Critical Impact

This vulnerability enables local code execution through a buffer overflow in the bezier_spline function, potentially allowing attackers to execute arbitrary code with local user privileges on affected systems.

Affected Products

• fig2dev version 3.2.9a
• Red Hat Enterprise Linux 6.0
• Red Hat Enterprise Linux 7.0
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0

Discovery Timeline

• April 23, 2025 - CVE-2025-46397 published to NVD
• January 19, 2026 - Last updated in NVD database

Technical Details for CVE-2025-46397

Vulnerability Analysis

CVE-2025-46397 is classified under CWE-120 (Buffer Copy without Checking Size of Input), a classic buffer overflow weakness. The vulnerability exists within the bezier_spline function in the fig2dev codebase. When processing specially crafted FIG format files, the function fails to properly validate the size of input data before copying it into a fixed-size buffer.

This buffer overflow condition allows an attacker to overwrite adjacent memory regions, potentially corrupting critical program data or control structures. Given the nature of the vulnerability requiring local access and a low-privileged user context, the exploitation scenario typically involves a user opening a malicious FIG file or processing it through automated workflows.

The vulnerability affects the confidentiality, integrity, and availability of the system, as successful exploitation could lead to complete control over the affected process and potential privilege escalation depending on the execution context.

Root Cause

The root cause of this vulnerability is the absence of proper bounds checking in the bezier_spline function when handling input data. The function copies data into a buffer without verifying that the input size does not exceed the allocated buffer capacity. This is a classic buffer overflow pattern (CWE-120) where improper validation of input length leads to memory corruption.

Attack Vector

The attack vector is local, requiring an attacker to have access to the system and the ability to provide malicious input to the fig2dev utility. Exploitation scenarios include:

1. Direct file processing - An attacker provides a crafted FIG file to a user who processes it with fig2dev
2. Automated processing pipelines - Systems that automatically convert FIG files could be targeted by submitting malicious files
3. Document conversion workflows - Any workflow that processes untrusted FIG format files is potentially vulnerable

The vulnerability requires low privileges to exploit and no user interaction beyond processing the malicious file. The bezier_spline function processes spline curve data from FIG files, and malformed spline definitions can trigger the buffer overflow condition.

Detection Methods for CVE-2025-46397

Indicators of Compromise

• Unexpected crashes or segmentation faults in fig2dev processes when processing FIG files
• Anomalous process behavior following fig2dev execution, including spawned child processes
• Memory corruption artifacts in fig2dev core dumps or crash logs
• Unusual file system or network activity initiated by fig2dev processes

Detection Strategies

• Monitor for fig2dev process crashes with segmentation fault or memory corruption signals
• Implement file integrity monitoring on systems that process FIG files automatically
• Deploy endpoint detection rules to identify anomalous behavior following fig2dev execution
• Use application sandboxing to contain potential exploitation attempts

Monitoring Recommendations

• Enable audit logging for fig2dev process executions across affected systems
• Monitor for unexpected privilege escalation attempts following fig2dev activity
• Implement file scanning for potentially malicious FIG files in upload directories
• Configure alerting for unusual memory consumption or crash patterns in document conversion services

How to Mitigate CVE-2025-46397

Immediate Actions Required

• Update fig2dev to the latest patched version available from your distribution
• Apply Red Hat security updates (RHSA-2026:0700, RHSA-2026:0704, RHSA-2026:0705, RHSA-2026:0756) on affected RHEL systems
• Restrict fig2dev execution to trusted users and isolate the utility in sandboxed environments
• Audit and validate all FIG files before processing, especially those from untrusted sources

Patch Information

Multiple vendors have released security updates addressing this vulnerability:

• Red Hat: Security advisories RHSA-2026:0700, RHSA-2026:0704, RHSA-2026:0705, and RHSA-2026:0756 provide patched packages for RHEL 6, 7, 8, and 9
• Debian: Updates available via the Debian LTS Announcement
• Upstream: The issue is tracked in SourceForge Ticket #192

For detailed CVE information from Red Hat, refer to the Red Hat CVE Analysis and Bug Report #2362058.

Workarounds

• Avoid processing untrusted FIG files until patches are applied
• Run fig2dev in a restricted container or sandbox environment to limit potential damage
• Implement mandatory access controls (SELinux, AppArmor) to constrain fig2dev process capabilities
• Temporarily disable automated FIG file processing workflows until systems are patched

# Example: Run fig2dev in a restricted environment using firejail
firejail --private --net=none fig2dev input.fig output.eps

# Example: Apply RHEL security updates
sudo yum update fig2dev
# or on RHEL 8/9
sudo dnf update fig2dev