CVE-2025-46400: 
NixOS vulnerability analysis and mitigation

CVE-2025-46400 was initially reported on April 23, 2025, but was subsequently rejected by Red Hat Product Security on April 30, 2025, as they determined that this CVE was not needed. The vulnerability was initially described as a segmentation fault in fig2dev version 3.2.9a that could affect availability through local input manipulation via the read_arcobject function (NVD, Ubuntu).

Before rejection, the vulnerability was assessed with a CVSS v3.1 base score of 7.1 (High), with the following vector string: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This indicates a locally exploitable vulnerability requiring low attack complexity and privileges, with no user interaction needed, and potential impacts on confidentiality and integrity (Ubuntu).

The initially reported vulnerability suggested potential impacts on system availability through a segmentation fault, with high impacts on both confidentiality and integrity. However, as the CVE was rejected, these impacts were not confirmed (NVD).

The vulnerability was initially reported as locally exploitable through input manipulation of the read_arcobject function in fig2dev version 3.2.9a. However, as the CVE was rejected, the exploitability status was not confirmed (CVE).

No mitigation or workarounds are necessary as Red Hat Product Security determined that this CVE was not needed and rejected it (NVD).