Moderate Security Vulnerability in Transfig: Stack Overflow Risk
Summary
RLSA-2026:0700: Moderate: transfig security update. Affects transfig versions < 1:3.2.7b-11.el9_7. Fixed in 1:3.2.7b-11.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Transfig is a utility that generates makefiles to convert FIG (created by xfig) or PIC figures into various LaTeX graphics languages, such as PostScript. It is widely used for creating portable TeX documents that can be printed across diverse environments. The utility's functionality is crucial for users who rely on graphical representations in their documents, but it has been found to have a security vulnerability that could lead to potential code execution.
Vulnerability Detail
The vulnerability identified as CVE-2025-46397 is a stack overflow issue in xfig, which is part of the Transfig package. This flaw allows for possible code execution through local input manipulation. If exploited, an attacker could potentially execute arbitrary code on the affected system, posing significant risks to data integrity and system security. The vulnerability has a CVSS score of 7.8, indicating a high level of severity.
How To Fix
Minimum fixed version
1:3.2.7b-11.el9_7
This is the first release that contains the fix.
sudo dnf update transfigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable features of xfig until the package is updated. It is advisable to limit the use of local input that could trigger the stack overflow vulnerability.
Conclusion
The Transfig utility has a moderate security vulnerability that could allow for code execution through a stack overflow. Users are advised to update their packages promptly to the latest version to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for transfig →
FAQ
The vulnerability is a stack overflow issue in xfig, which can lead to code execution through local input manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Update the Transfig package to the latest patched version using 'sudo dnf update transfig' to protect your system from this vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for transfig.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
