Moderate Security Vulnerability in Transfig Package: Stack Overflow Risk
Summary
ALSA-2026:0700: Moderate: transfig security update. Affects transfig versions < 1:3.2.7b-11.el9_7. Fixed in 1:3.2.7b-11.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Transfig is a utility that translates FIG and PIC figures into various graphics languages, such as LaTeX and PostScript. It is widely used for creating portable TeX documents that can be printed across diverse environments. However, a recent security issue has been identified that could potentially allow for code execution through local input manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2025-46397, is a stack overflow issue in the xfig component of the Transfig package. This flaw arises from improper handling of local input, which could allow an attacker to execute arbitrary code on the affected system. The ramifications of this vulnerability are significant, as it could lead to unauthorized access and control over the system running the vulnerable version of Transfig.
How To Fix
Minimum fixed version
1:3.2.7b-11.el9_7
This is the first release that contains the fix.
sudo dnf update transfigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the xfig component of Transfig until the package is updated. Additionally, ensure that any input to the utility is sanitized to minimize the risk of exploitation.
Conclusion
The Transfig package has a moderate security vulnerability that could allow for code execution through a stack overflow in the xfig component. Users are strongly advised to update to the latest patched version to mitigate this risk. For those unable to update immediately, implementing workarounds and using tools like Vulert can help monitor and manage the vulnerability.
See every vulnerability recorded for transfig →
FAQ
The vulnerability is a stack overflow issue in the xfig component, allowing possible code execution via local input manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary code, leading to unauthorized access and control over the affected system.
Yes, a patched version of the Transfig package is available. Users should update to version 1:3.2.7b-11.el9_7 or later.
If immediate updating is not possible, avoid using the xfig component and ensure that all input is properly sanitized to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for transfig.
