CVE-2009-4227

Xfig < 3.2.5b - Stack-based Buffer Overflow via Malformed .fig File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4227. PoCs published by pedamachephepto.

AI-analyzed exploit summary This Fortran PoC exploits a stack-based buffer overflow in Xfig and Transfig by generating a malformed .fig file with an oversized string, leading to arbitrary code execution or denial-of-service.

Description

Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED
by pedamachephepto · remotelinux
https://www.exploit-db.com/exploits/33388

This Fortran PoC exploits a stack-based buffer overflow in Xfig and Transfig by generating a malformed .fig file with an oversized string, leading to arbitrary code execution or denial-of-service.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Xfig <= 3.2.5B, Transfig <= 3.2.5A
No auth needed
Prerequisites: ability to deliver a malformed .fig file to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37577
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/12/03/2
Issue Tracking x_refsource_confirm
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/37193
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:010
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/54525
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0108
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=543905
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37571

Scores

EPSS 0.1500
EPSS Percentile 94.7%

Details

CWE
CWE-119
Status published
Products (2)
xfig/xfig 3.2.5
xfig/xfig < 3.2.5b
Published Dec 08, 2009
Tracked Since Feb 18, 2026