CVE-2025-46397

What it actually does

A buffer overflow in the bezier_spline function allows local attackers to execute arbitrary code through crafted input manipulation.

Why it matters to the business

Attackers can gain full control of affected systems, potentially leading to data breaches or system compromise. The vulnerability affects aws/aws-cdk with many dependents.

How an attack unfolds

An attacker with local access crafts malicious input that triggers the buffer overflow in bezier_spline, leading to code execution.

How to fix it

Update aws/aws-cdk to commit b396961272695cd70ac183fdaf842ffb48f5d91f or later.

How to confirm the fix worked

Verify the fixed commit is present in the codebase and test with malformed bezier spline inputs to confirm no overflow occurs.

Typical attack path

1. Obtain local access to the system
2. Craft malicious input targeting the bezier_spline function
3. Trigger the function via local file or input manipulation
4. Exploit the buffer overflow to execute arbitrary code

How to detect it

Examine system logs for crashes or unexpected behavior in processes handling bezier splines or xfig files; check for unauthorized code execution artifacts post-local access.

What your security team should do

• Apply the specified commit update immediately across all instances
• Review local input handling in drawing or spline processing code
• Monitor for any local privilege escalation attempts