A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16140.json"