CVE-2025-46400

What it actually does

Local input manipulation in the read_arcobject function of fig2dev triggers a segmentation fault, resulting in memory corruption that crashes the process and denies availability.

Why it matters to the business

Attackers with local access can crash diagramming workflows on affected Red Hat systems, disrupting operations that rely on xfig for diagram conversion; the issue affects many kernel packages in mission-critical RHEL 6.2 environments, amplifying operational downtime risk despite low EPSS and no known exploitation.

How an attack unfolds

An attacker with local access supplies a specially crafted diagram file to fig2dev; the malformed input reaches read_arcobject and triggers a segmentation fault, crashing the process without requiring elevated privileges or network interaction.

How to fix it

Upgrade all listed packages to the fixed versions: kernel, kernel-debug, kernel-debug-debuginfo, kernel-debug-devel, kernel-debuginfo, kernel-debuginfo-common-x86_64, kernel-devel, kernel-doc, kernel-firmware, kernel-headers, perf, perf-debuginfo, python-perf, and python-perf-debuginfo to 0:2.6.32-220.63.2.el6 on Red Hat rhel_mission_critical:6.2::server.

How to confirm the fix worked

Verify package versions match the fixed releases using rpm -q on each listed package; test fig2dev against known crashing inputs to confirm the segmentation fault no longer occurs.

Typical attack path

1. Obtain local access to a system running affected xfig/fig2dev binaries
2. Craft a malicious input file targeting the arc object parser
3. Invoke fig2dev with the malicious file as input
4. Trigger segmentation fault in read_arcobject causing immediate process crash

How to detect it

Review local process crash logs and core dumps for fig2dev segmentation faults; inspect command-line invocations and file access timestamps around any xfig-related crashes.

What your security team should do

• Prioritize patching all listed kernel packages to 0:2.6.32-220.63.2.el6 within standard change windows
• Restrict local execution of fig2dev to trusted users and inputs until patches are applied
• Monitor for new public exploits given the 535 days since publication and slight EPSS increase