PT-2025-17669 · Fig2Dev+4 · Fig2Dev+4

Liuchenyifan · Published 2025-02-14 · Updated 2026-01-19 · CVE-2025-46397

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fig2dev version 3.2.9a

Description The issue allows an attacker possible code execution via local input manipulation through the bezier spline function.

Recommendations For fig2dev version 3.2.9a, consider disabling the bezier spline function until a patch is available to prevent potential code execution via local input manipulation.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-120

Related Identifiers

ALSA-2026:0700

ALSA-2026:0756

BDU:2025-11851

CVE-2025-46397

DLA-4147-1

MGASA-2025-0253

OESA-2025-1509

OESA-2025-1510

OESA-2025-1947

OESA-2025-1948

OESA-2025-1949

OPENSUSE-SU-2025:15155-1

RHSA-2026:0700

RHSA-2026:0704

RHSA-2026:0705

RHSA-2026:0756

SUSE-SU-2025:01835-1

SUSE-SU-2025:01835-2

SUSE-SU-2025:01890-1

SUSE-SU-2025_01890-1

Affected Products

Astra Linux

Debian

Rocky Linux

Suse

Fig2Dev

References · 83

• 🔥 https://sourceforge.net/p/mcj/tickets/192 · Exploit
• https://access.redhat.com/errata/RHSA-2026:0756 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:0700 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11851 · Security Note
• https://access.redhat.com/errata/RHSA-2026:0705 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46397 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:0756 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2362058 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1510 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15155-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-0756.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-46397 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1948 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01890-1 · Vendor Advisory