Skip to main content

ncurses EUVDEUVD-2025-18429

| CVE-2025-6141 MEDIUM
Buffer Overflow (CWE-119)
2025-06-16 cna@vuldb.com
Buffer Overflow
4.8
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local attack, low privileges, low availability impact only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
LOW
qualitative
SUSE
1.7 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
3.3 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Severity Changed
Jun 02, 2026 - 14:22 NVD
LOW MEDIUM
CVSS changed
Jun 02, 2026 - 14:22 NVD
3.3 (LOW) 4.8 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 14, 2026 - 21:59 euvd
EUVD-2025-18429
Analysis Generated
Mar 14, 2026 - 21:59 vuln.today
CVE Published
Jun 16, 2025 - 22:16 nvd
LOW 3.3
CVE Published
Jun 16, 2025 - 22:16 cve.org
MEDIUM 4.8

DescriptionCVE.org

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

AnalysisAI

Stack-based buffer overflow in GNU ncurses up to 6.5-20250322 allows local attackers to cause a denial of service via crafted termcap data. The vulnerability is in the postprocess_termcap function and requires local access with low privileges. No public exploit or active exploitation identified; EPSS score is low (0.03%).

Technical ContextAI

The vulnerability is a stack-based buffer overflow (CWE-119) in the postprocess_termcap function within tinfo/parse_entry.c of GNU ncurses. ncurses is a library for terminal-independent screen handling, widely used in Unix-like systems. The termcap database describes terminal capabilities; processing malformed termcap entries can overflow a stack buffer. CPE data indicates ncurses versions up to 6.5-20250322 are affected.

RemediationAI

Upgrade to ncurses version 6.5-20250329 or later, which contains the fix. The patch is available from the vendor. For systems where immediate upgrade is not possible, restrict local access to trusted users only, as the attack requires local access. No workaround other than limiting local user capabilities.

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Low
ncurses
Release Status Version
noble needs-triage -
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
upstream needs-triage -
oracular ignored end of life, was needs-triage
questing needs-triage -
plucky ignored end of life, was needs-triage

Debian

Bug #1107937
ncurses
Release Status Fixed Version Urgency
bullseye vulnerable 6.2+20201114-2+deb11u2 -
bookworm vulnerable 6.4-4 -
trixie vulnerable 6.5+20250216-2 -
forky, sid fixed 6.6+20251231-1 -
experimental fixed 6.5+20251115-1 -
(unstable) fixed 6.5+20251115-2 -

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

Share

EUVD-2025-18429 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy