Log in Start free

Vulnerability · Published Jun 16, 2025 · Assigned by VulDB

CVE-2025-6141GNU ncurses parse_entry.c postprocess_termcap stack-based overflow

Low 3.3

In plain English

A low-severity stack buffer overflow in ncurses from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ncursesno fix listedDEBIAN-CVE-2025-6141
Debian:13ncursesno fix listedDEBIAN-CVE-2025-6141
Debian:14ncurses6.5+20251115-2DEBIAN-CVE-2025-6141
Ubuntu:22.04:LTSncurses6.3-2ubuntu0.3USN-8709-1
Ubuntu:22.04:LTSncurses6.3-2ubuntu0.3UBUNTU-CVE-2025-6141
Ubuntu:24.04:LTSncurses6.4+20240113-1ubuntu2.2UBUNTU-CVE-2025-6141
Ubuntu:24.04:LTSncurses6.4+20240113-1ubuntu2.2USN-8709-1
Ubuntu:25.10ncursesno fix listedUBUNTU-CVE-2025-6141

Affected products (as reported)

VendorProductVersions
GNU ncurses 6.5-20250322

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References