CVE-2025-46399: Fig2dev DOS Vulnerability

CVE-2025-46399 Overview

CVE-2025-46399 is a null pointer dereference vulnerability [CWE-476] in fig2dev, a utility that converts FIG format graphics files to other formats such as PostScript, PDF, and LaTeX. The flaw resides in the genge_itp_spline function and can be triggered through crafted local input. Successful exploitation causes the process to terminate, resulting in a denial of service against integrity of the conversion workflow. The vulnerability affects fig2dev version 3.2.9a and is shipped in Red Hat Enterprise Linux 6, 7, 8, and 9. No remote attack vector exists, and authenticated local access is required.

Critical Impact
A local attacker can crash fig2dev by supplying a malformed FIG file, disrupting automated document conversion pipelines and any service that renders untrusted FIG input.

Affected Products

fig2dev 3.2.9a (fig2dev_project)
Red Hat Enterprise Linux 6, 7, 8, 9
Debian LTS distributions shipping fig2dev

Discovery Timeline

2025-04-23 - CVE-2025-46399 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-46399

Vulnerability Analysis

The vulnerability affects the genge_itp_spline function within fig2dev, which handles interpolated spline generation during FIG-to-output conversion. When the function processes a specially crafted FIG object, control flow reaches a pointer that was never initialized or was returned as NULL by an upstream allocation or lookup. Dereferencing this pointer triggers a segmentation fault and terminates the process. The issue is classified as a null pointer dereference [CWE-476]. The Exploit Prediction Scoring System places this issue in the low-probability tier, consistent with a local availability-only impact and no observed in-the-wild exploitation.

Root Cause

The root cause is missing validation of a pointer used inside genge_itp_spline before dereference. FIG file input drives allocation and object lookup routines in fig2dev. When input violates expected structural invariants — for example, a spline object with an unexpected point count or degenerate control-point configuration — the upstream routine returns without producing a valid object, but genge_itp_spline proceeds as if the pointer were valid.

Attack Vector

An attacker requires local access and the ability to supply a FIG file to a user or automated service that invokes fig2dev. The attacker crafts a FIG document containing a malformed interpolated spline definition. When the target renders the file, fig2dev crashes. The impact is limited to loss of integrity or availability of the conversion job. Confidentiality is not affected, and no code execution is possible through this flaw. See the SourceForge ticket #190 and Red Hat Bug Report #2362053 for the upstream technical discussion.

Detection Methods for CVE-2025-46399

Indicators of Compromise

Segmentation fault or SIGSEGV termination of fig2dev processes logged in system journals
Core dumps referencing the genge_itp_spline symbol in the fig2dev binary
FIG files with malformed spline object headers arriving from untrusted sources
Unexpected failure of document build pipelines that invoke fig2dev on user-supplied input

Detection Strategies

Monitor process exit codes and crash telemetry for fig2dev invocations, correlating with the input filename processed at the time of failure.
Inspect FIG files for anomalous spline object definitions before they reach the converter, particularly point-count fields that do not match the actual point list.
Enable abrtd or systemd-coredump collection on RHEL systems to capture stack traces that include genge_itp_spline for forensic analysis.

Monitoring Recommendations

Alert on repeated fig2dev crashes from the same source user or automated job, indicating deliberate probing.
Track package versions of transfig and fig2dev across RHEL 6, 7, 8, and 9 hosts to identify unpatched systems.
Log all invocations of fig2dev in build servers and document conversion services with the input file hash for post-incident review.

How to Mitigate CVE-2025-46399

Immediate Actions Required

Apply the vendor patch from Red Hat or the Debian LTS security team as soon as it is available for your distribution.
Restrict fig2dev execution to trusted FIG files by validating input sources before conversion.
Isolate document conversion services in sandboxed environments to contain crashes and prevent cascading service failures.

Patch Information

Red Hat tracks this issue in the Red Hat CVE-2025-46399 Advisory and Bugzilla #2362053. Debian LTS users should reference the Debian LTS Announcement April 2025 for the updated transfig package. Upstream discussion is captured in SourceForge ticket #190.

Workarounds

Restrict local user access to systems running fig2dev until patches are installed.
Wrap fig2dev invocations in a supervisor process that catches abnormal termination and prevents pipeline stalls.
Pre-validate FIG file structure using a schema-aware parser before invoking the converter on untrusted content.

bash

# Verify installed fig2dev version and check for pending updates
rpm -q fig2dev transfig
yum --security check-update | grep -i fig2dev

# Run fig2dev under a resource-limited, non-privileged service account
systemd-run --uid=nobody --gid=nobody --property=LimitCORE=0 \
    /usr/bin/fig2dev -L pdf input.fig output.pdf