CVE-2014-1235: Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute...

Security readout for executives and security teams

Graphviz 2.34.0 can crash or potentially run attacker-controlled code when it processes a crafted file. The CVE notes this was caused by an incomplete fix for CVE-2014-0978. Business risk is highest where Graphviz renders untrusted user-supplied graph files or diagrams in automated services. Exposure is most likely in systems running Graphviz 2.34.0 that parse files from users, partners, email attachments, repositories, CI jobs, or web upload workflows. Internal-only diagram generation from trusted content lowers likelihood but does not remove the need to patch. Prioritize remediation if Graphviz handles external or semi-trusted files, because the stated impact includes code execution and denial of service. If usage is limited to trusted offline workflows, treat as a controlled but still necessary patching task. Mitigation focus: Update Graphviz using the relevant vendor or distribution advisory.; Confirm the installed package includes the upstream yyerror fix.; Restrict Graphviz processing to trusted files until remediation is complete..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.