Moderate Vulnerability in Transfig Package: Stack Overflow Risk
Summary
RLSA-2026:0756: Moderate: transfig security update. Affects transfig versions < 1:3.2.6a-5.el8_10. Fixed in 1:3.2.6a-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Transfig is a utility that creates makefiles to translate FIG or PIC figures into various LaTeX graphics languages, such as PostScript. It is widely used for generating portable TeX documents that can be printed across different environments. This package is essential for users who need to convert graphical representations into formats suitable for LaTeX documents.
Vulnerability Detail
The vulnerability identified in the Transfig package is a stack overflow issue associated with the xfig component. This flaw allows for potential code execution through local input manipulation, which could lead to unauthorized access or control over the affected system. The vulnerability is tracked under CVE-2025-46397 and has a CVSS score of 7.8, indicating a moderate severity level. Attackers could exploit this vulnerability by crafting malicious input that, when processed by xfig, could execute arbitrary code.
How To Fix
Minimum fixed version
1:3.2.6a-5.el8_10
This is the first release that contains the fix.
sudo dnf update transfigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the xfig component of Transfig until the package is updated. Additionally, ensure that any input to xfig is sanitized and validated to prevent exploitation of the stack overflow vulnerability.
Conclusion
The Transfig package has a moderate vulnerability that could allow for code execution through a stack overflow in the xfig component. Users are strongly advised to update to the latest version to protect their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for transfig →
FAQ
The vulnerability is a stack overflow issue in the xfig component, which can lead to potential code execution through local input manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the Transfig package to the fixed version 1:3.2.6a-5.el8_10 using the command 'sudo yum update transfig' to mitigate the vulnerability.
The CVSS score of this vulnerability is 7.8, indicating a moderate severity level.
Yes, avoid using the xfig component of Transfig until the package is updated, and ensure that any input to xfig is sanitized.
Related vulnerabilities
Recent vulnerabilities recorded for transfig.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
