CVE-2009-1962: Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1)...

Security readout for executives and security teams

CVE-2009-1962 is an old local file-handling flaw in Xfig. A local user could abuse predictable temporary file names to read or write arbitrary files. It is not described as remotely exploitable, and the supplied sources do not show active exploitation. Exposure is most likely on Unix/Linux systems where Xfig is installed and untrusted local users can run it or influence its execution environment. Treat as a targeted local-privilege exposure, not an internet-facing emergency. Prioritize shared Linux/Unix systems, legacy desktops, and environments where Xfig may run with sensitive file access. Mitigation focus: Inventory systems for Xfig installations and package source.; Check current vendor or distribution guidance for supported fixed packages.; Remove Xfig where it is not operationally required..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.