CVE-2025-46398

What it actually does

Stack-based buffer overflow in the read_objects function of fig2dev allows memory corruption via local input manipulation.

Why it matters to the business

Local attackers can corrupt memory on affected systems, potentially disrupting diagramming workflows or causing integrity issues with no remote or privilege escalation impact.

How an attack unfolds

An attacker with local access crafts a malicious input file that triggers the stack overflow when processed by fig2dev through the read_objects function, leading to memory corruption.

How to fix it

Upgrade katex/katex (GIT) to the fixed commit ff289955e81aab89086eef09254cbf88573d415c.

How to confirm the fix worked

Verify the installed version matches the fixed commit ff289955e81aab89086eef09254cbf88573d415c and test processing of sample inputs without triggering overflow conditions.

Typical attack path

1. Obtain local access to a system with the vulnerable tool
2. Craft a specially formatted input file to trigger the overflow
3. Invoke fig2dev on the malicious input to cause memory corruption

How to detect it

Review local process execution logs and file access records for invocations of fig2dev on untrusted inputs around the time of any memory-related crashes.

What your security team should do

• Apply the fixed commit immediately due to the 535 days since publication
• Restrict local execution of fig2dev to trusted users
• Monitor for any local file processing anomalies