Name: CVE-2025-46397: Buffer Copy without Checking Size of Input
Creator: Rapid7
Published: 2025-04-23T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2025-46397, CWE-120, CVSS 7.8, EPSS 0.00305

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade transfig	Jan 20, 2026	Jan 15, 2026
Alpine Linux	—	Upgrade fig2dev	Aug 20, 2026	Apr 23, 2025
Debian	—	Upgrade fig2dev	May 20, 2025	Apr 23, 2025
Oracle_linux	—	Upgrade transfig	Jan 19, 2026	Apr 23, 2025
Redhat_linux	—	Upgrade transfig-debugsourceUpgrade transfig-debuginfoUpgrade transfigNo solution exists	Jul 9, 2025	Apr 23, 2025
Rocky_linux	—	Upgrade transfigUpgrade transfig-debugsourceUpgrade transfig-debuginfo	Jan 19, 2026	Jan 17, 2026
Suse	—	Upgrade transfig	Dec 5, 2025	Jun 9, 2025

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence