CVE-2023-46045 is a high severity (CVSS 7.8) out-of-bounds read in Graphviz, reached through a crafted config6a file. The record lists Graphviz 2.36.0 through 9.x before 10.0.1 as affected. Update to 10.0.1 or later. The record itself says exploitability may be uncommon, and a Graphviz maintainer disputes the affected range.
What's affected
The record says Graphviz 2.36.0 through 9.x, before 10.0.1, is affected, which points to 10.0.1 as the fixed release. The record adds a note that exploitability may be uncommon because the config6a file is typically owned by root.
There is a conflict in the sources. A Graphviz maintainer wrote on the oss-security list that whether this has any security impact is environment specific, that the listed affected versions are wrong, and that the project was not consulted before the CVE was requested. We could not fetch the Full Disclosure post or the project issue, so treat the exact range as unsettled. Check the Graphviz release notes and your distribution advisory.
The NVD record scores it 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-125 (out-of-bounds read). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the installed version on each host:
dot -V
On Debian and Ubuntu you can also run dpkg -l graphviz. In container images, run the same command inside the image. For language bindings that bundle Graphviz, check the binding's own version and its notes.
Then ask who can write to the Graphviz plugin configuration directory. The config6a file is the plugin config that Graphviz reads at startup, and the risk depends on who controls it.
What to do now
- List hosts, images and CI runners that have Graphviz installed, including those pulled in by documentation or diagram tools.
- Update to 10.0.1 or later, or to the package your distribution marks as fixed for this CVE.
- Make sure the Graphviz config directory is writable only by root or an administrator.
- Rebuild container images that bundle an older Graphviz and redeploy them.
- Run a dependency scan again so the finding closes. Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether the affected package is in your tree.
Why it matters
An out-of-bounds read means the program reads past the end of a buffer. Here the trigger is a configuration file rather than a graph file, which is why the maintainer and the CVSS vector tell different stories. The vector assumes local access and a user action, with high impact.
The weakness is CWE-125. In practice, the safest reading is that file permissions on the config decide your real exposure. If only root can change it, the path is narrow. If a shared build system can change it, it is not.
Try it yourself
Graphviz often arrives as an indirect dependency of other tools. This demo shows how an inventory answers where it is installed.
Click through it at your own pace, or open it full screen.
Quick check
Is Graphviz 9.0 affected?
The record lists 2.36.0 through 9.x as affected, but a maintainer disputes that range. Check the project release notes and your distribution advisory.
Does opening a normal dot file trigger this?
The description points to a crafted config6a file, not a normal graph file.
Sources
Last reviewed: 19 October 2026.
