Description
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | graphviz | 2.38.0-7 | — |
| Debian 13 | graphviz | 2.38.0-7 | — |
| Debian 12 | graphviz | 2.38.0-7 | — |
| Debian 7 | graphviz | 2.26.3-14+deb7u2 | DSA-3098-1 |
| Debian 6.0 | graphviz | 2.26.3-5+squeeze3 | DLA-105-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | graphviz | 2.36.0-0ubuntu3.1 | USN-2435-1 |
Advisories 3
- USN-2435-1 graphviz vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3098-1 graphviz - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-105-1 graphviz - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2014:248 vendor-advisory
- graphviz-format-sting(98949) vdb-entry
- MDVSA-2015:187 vendor-advisory
- [oss-security] 20141201 Re: Re: CVE Request: Graphviz format string vuln mailing-list
- http://advisories.mageia.org/MGASA-2014-0520.html
- 71283 vdb-entry
- https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081
- DSA-3098 vendor-advisory
- 60166 third-party-advisory
- [oss-security] 20141125 CVE Request: Graphviz format string vuln mailing-list