What’s Vulnerable › Vulnerabilities

CVE-2019-18604

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-29 · updated 2026-06-17

Description

In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled.

Affected products

• Axodraw2 Project Axodraw2: through 2.1.1
• Axohelp.C Project Axohelp.C: before 1.3 — fixed in 1.3

How to fix

Upgrade to a fixed version: Axohelp.C Project Axohelp.C 1.3. Check the vendor advisory for mitigations.

References

• https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a
• https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html
• https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a
• https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html

Get alerted when CVE-2019-18604 or the next vulnerability affects your stack