CVE-2025-46399

What it actually does

Improper input validation in the genge_itp_spline function permits a local attacker to supply crafted input that disrupts service availability without requiring elevated privileges.

Why it matters to the business

Local disruptions can halt processing of graphics or figure data in affected installations, leading to operational delays until the component is updated or input is sanitized.

How an attack unfolds

An attacker with local access identifies a code path invoking genge_itp_spline, supplies manipulated input that bypasses validation, and triggers the flaw to affect availability; no remote or unauthenticated vectors apply.

How to fix it

Upgrade goalgorilla/open_social to version 12.4.5 or 13.0.0-alpha11; verify the update resolves the input validation flaw in the dependent fig2dev component.

How to confirm the fix worked

Confirm the installed package version matches a fixed release, then test the function with boundary and malformed inputs to ensure no availability impact occurs.

Typical attack path

1. Obtain local access to a system running the vulnerable package
2. Locate or trigger execution of the genge_itp_spline function
3. Provide specially crafted local input
4. Observe resulting availability impact

How to detect it

Review local process logs and application error output for repeated failures or crashes originating from genge_itp_spline calls with unexpected input patterns.

What your security team should do

• Apply the listed fixed versions across all installations without delay
• Audit local input sources that reach graphics processing routines
• Implement input sanitization wrappers until patches are deployed