CVE-2014-9157: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attacker...

Security readout for executives and security teams

Graphviz had a format string flaw in error handling. If Graphviz processed specially crafted input, the impact was not specified in the source data. Treat this as relevant where Graphviz processes external diagrams or files, but the provided sources do not support a severity score or active exploitation claim. Exposure is most likely in systems running Graphviz that parse untrusted or user-supplied graph content, including document rendering, CI documentation jobs, web upload workflows, or automation pipelines. Exact affected versions are not listed in the supplied source bundle. Track this as a targeted remediation item, not an emergency, unless Graphviz handles untrusted input in business-facing services. The absence of severity, CVSS, and exploitation evidence limits urgency, but vendor-patched exposure should still be closed. Mitigation focus: Update Graphviz using your operating system or vendor security advisory channel.; Prioritize hosts where Graphviz processes externally supplied graph files.; Check vendor guidance for exact fixed versions and package names..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.