CVE-2025-46400: Fig2dev DOS Vulnerability

CVE-2025-46400 Overview

CVE-2025-46400 is a null pointer dereference vulnerability [CWE-476] in the fig2dev utility, part of the xfig diagramming toolset. The flaw resides in the read_arcobject function and triggers a segmentation fault when the tool processes malformed input. A local attacker with low privileges can craft a malicious Fig file to crash the fig2dev process, disrupting availability of any workflow that depends on it.

The vulnerability affects fig2dev version 3.2.9a and multiple Red Hat Enterprise Linux releases that ship the utility. No remote exploitation vector exists, and the impact is limited to availability of the running process.

Critical Impact
A local attacker can trigger a segmentation fault in fig2dev by supplying a crafted Fig file processed by read_arcobject, resulting in denial of service for any user or automated pipeline invoking the converter.

Affected Products

fig2dev 3.2.9a (fig2dev_project)
Red Hat Enterprise Linux 6, 7, 8, and 9
Debian distributions shipping the affected xfig/fig2dev package

Discovery Timeline

2025-04-23 - CVE-2025-46400 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-46400

Vulnerability Analysis

The fig2dev tool converts Fig-format diagram files into other graphics formats such as PostScript, PDF, and SVG. During parsing, the read_arcobject function processes arc object definitions embedded in the Fig input file. When the function encounters unexpected or malformed values, it dereferences a pointer that has not been properly validated, producing a segmentation fault.

Because the crash occurs during input parsing, any process invoking fig2dev on attacker-controlled input is affected. Automated document conversion pipelines, build systems, and scripts that batch-process Fig files inherit the same exposure. The vulnerability does not permit code execution or information disclosure, but it interrupts availability and can be used to derail scripted conversions.

Root Cause

The root cause is missing input validation inside read_arcobject. The function assumes that parsed structural elements of an arc object are present and well-formed. When the input deviates from expectations, an internal pointer remains uninitialized or is set to NULL, and the subsequent dereference terminates the process. This is a classic [CWE-476] Null Pointer Dereference pattern.

Attack Vector

Exploitation requires local access with the ability to supply a Fig file to fig2dev. The attacker crafts a Fig file containing a malformed arc object definition and delivers it through any interface that eventually calls the converter — command-line invocation, shared document directories, or automated build steps. When fig2dev reaches read_arcobject, the process crashes with a segmentation fault.

Refer to the SourceForge MCJ Ticket #187 and the Red Hat Bug Report #2362054 for reproducer details.

Detection Methods for CVE-2025-46400

Indicators of Compromise

Segmentation fault entries in system logs referencing the fig2dev binary
Core dump files generated by crashed fig2dev processes
Unexpected termination of document conversion jobs that process Fig files from untrusted sources

Detection Strategies

Monitor process exit codes and signal terminations for fig2dev, alerting on SIGSEGV (signal 11) events
Audit systems for the vulnerable fig2dev 3.2.9a version using package inventory queries
Correlate crashes with recent access to Fig files originating from untrusted or user-writable locations

Monitoring Recommendations

Enable core dump collection in environments that run fig2dev and centralize the results for review
Track invocation of fig2dev in build pipelines and document servers, flagging repeated failures on the same input
Ingest kernel and systemd-coredump logs into a central log platform to identify segmentation faults across hosts

How to Mitigate CVE-2025-46400

Immediate Actions Required

Apply the updated fig2dev package from your Linux distribution's security repositories as soon as it is available
Restrict execution of fig2dev to trusted input paths and avoid processing Fig files from untrusted users
Remove or disable fig2dev on systems where it is not required for business operations

Patch Information

Red Hat has published tracking and remediation guidance in the Red Hat CVE-2025-46400 Advisory. Debian users should follow the Debian LTS Announcement April 2025 for updated packages. Upstream fixes are tracked in SourceForge MCJ Ticket #187.

Workarounds

Validate Fig files with a schema or sanity check before passing them to fig2dev
Run fig2dev under a restricted user account or sandbox such as firejail or a container to contain crash impact
Disable automated batch conversion of externally supplied Fig files until the patched package is deployed

bash

# Verify the installed fig2dev version and remove the vulnerable package if unused
rpm -q fig2dev            # Red Hat / RHEL
dpkg -l | grep fig2dev    # Debian / Ubuntu

# Update to the patched package
sudo dnf update fig2dev   # RHEL 8/9
sudo apt-get update && sudo apt-get install --only-upgrade fig2dev  # Debian