Segmentation Fault in fig2dev Package: CVE-2025-46400 Vulnerability Overview
Summary
UBUNTU-CVE-2025-46400: Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via read_arcobject function. Affects fig2dev versions 1:3.2.6a-3 – 1:3.2.6a-6ubuntu1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The fig2dev package is a tool used for converting figures from various formats into device-independent formats. It is commonly utilized in scientific and academic environments for generating high-quality graphics. The package is designed to handle complex graphical data, but it has been found to have a critical vulnerability that could lead to system instability.
Vulnerability Detail
The vulnerability identified as CVE-2025-46400 is a segmentation fault in the fig2dev package, specifically in version 3.2.9a. This flaw allows an attacker to manipulate local input through the read_arcobject function, potentially leading to a denial of service by crashing the application. The issue arises from improper handling of input data, which can be exploited to disrupt the availability of the service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the fig2dev tool until the package is updated. Additionally, validating input data before processing it can help mitigate the risk of triggering the segmentation fault.
Conclusion
The CVE-2025-46400 vulnerability in the fig2dev package poses a significant risk due to its potential to cause application crashes. Users are advised to update to the latest version of the package to ensure system stability and security. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for fig2dev →
FAQ
CVE-2025-46400 is a vulnerability in the fig2dev package that causes a segmentation fault, allowing potential denial of service through local input manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes, resulting in denial of service and potential disruption of services relying on fig2dev.
Yes, a patched version of the fig2dev package is available. Users should update to the latest version to mitigate the risk.
Vulert is a service that monitors and alerts users about open-source vulnerabilities in software by analyzing manifest files like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for fig2dev.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
