Skip to main content

N A CVE-2025-69720

HIGH
Classic Buffer Overflow (CWE-120)
2026-03-19 mitre
Buffer Overflow N A
High
Disputed · 7.3 NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-120
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

While CVSS and CVSS vector data are not available for this CVE, multiple risk indicators suggest moderate to high real-world concern. The availability of a public proof-of-concept exploit on GitHub significantly elevates practical exploitability. The vulnerability's location in a utility program (infocmp) rather than the core library limits its scope compared to a core ncurses library flaw, but infocmp is often used in system administration and package building workflows. The buffer overflow nature (CWE-120/121) indicates potential for code execution if stack memory layout permits. Attack complexity appears low—the vulnerability can likely be triggered through command-line input without special privileges. The lack of KEV status confirmation and EPSS data prevents full quantitative risk assessment, but the public POC combined with the straightforward exploitation method suggests this should be prioritized for patching in systems where infocmp is exposed to untrusted input or runs with elevated privileges.
Exploit ScenarioDerived

An attacker with local access or the ability to provide input to infocmp could craft a specially formatted terminfo string or command-line argument designed to overflow the buffer in analyze_string(). For example, providing an excessively long terminal capability definition to infocmp would trigger the vulnerability, potentially allowing the attacker to overwrite stack memory and achieve denial of service or, depending on memory layout and protections, execute arbitrary code with the privileges of the user running infocmp. The public proof-of-concept code on GitHub demonstrates the precise method to trigger this overflow, lowering the barrier to exploitation.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 19, 2026

A buffer overflow vulnerability exists in ncurses versions 6.4 and 6.5 within the infocmp utility's analyze_string() function in progs/infocmp.c. This vulnerability allows an attacker to trigger a buffer overflow by providing maliciously crafted input to the infocmp program, potentially leading to denial of service or arbitrary code execution. A proof-of-concept exploit has been publicly released on GitHub, increasing the practical risk of exploitation.

RemediationAI

Upgrade ncurses to version 6.6 or later when available from your distribution. Users should check their vendor's ncurses package repository for patched versions addressing CVE-2025-69720. As an interim measure, limit access to the infocmp utility through file permissions or remove it entirely if not required for production operations. If infocmp must remain available, restrict its execution through AppArmor, SELinux, or similar mandatory access control mechanisms to prevent exploitation of the buffer overflow. Monitor system logs for unexpected infocmp invocations or crashes. Refer to your Linux distribution's security advisory (e.g., from Ubuntu, Debian, Red Hat) for specific patch availability and timelines.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ncurses is a widely-used C library providing terminal control and text-based user interface capabilities across Unix-like systems. The infocmp utility is a command-line tool included with ncurses that compares and analyzes terminfo database entries. The vulnerability resides in the analyze_string() function within progs/infocmp.c, which processes terminal capability strings without proper bounds checking. This is a classic CWE-120 (Buffer Copy without Checking Size of Input) or CWE-121 (Stack-based Buffer Overflow) vulnerability where input string processing fails to validate length constraints before writing to a fixed-size buffer. The affected products are identified under ncurses through the generic CPE reference, with confirmed impact on versions 6.4 and 6.5.

Know when N A gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 7.3 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 08:30 nvd
Patch available
CVE Published
Mar 19, 2026 - 00:00 nvd
HIGH 7.3

DescriptionCVE.org

ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function analyze_string().

Executive ViewAI

Why It Matters

CVE-2025-69720 presents moderate security risk, a buffer overflow vulnerability rated CVSS 7.3. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-05
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:5913 ADVISORY https://vuldb.com/?id.351721 REF https://cert-portal.siemens.com/productcert/html/ssa-253495.html REF https://github.com/Cao-Wuhui/CVE-2025-69720 REF https://invisible-island.net/archives/ncurses/6.5/ REF https://invisible-island.net/ncurses/ REF https://marc.info/?l=ncurses-bug&m=176539968328570&w=2 REF https://marc.info/?l=ncurses-bug&m=176540731801330&w=2 REF https://marc.info/?l=ncurses-bug&m=176545557728083&w=2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy