Vulnerability · Published Mar 19, 2026 · Assigned by mitre
CVE-2025-69720
High 7.3
In plain English
A high-severity stack buffer overflow in ncurses from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | ncurses-base | 6.4-15.20240127.el10_1 | ALSA-2026:5913 |
| AlmaLinux:10 | ncurses-term | 6.4-15.20240127.el10_1 | ALSA-2026:5913 |
| Debian:12 | ncurses | no fix listed | DEBIAN-CVE-2025-69720 |
| Debian:13 | ncurses | no fix listed | DEBIAN-CVE-2025-69720 |
| Debian:14 | ncurses | 6.6+20251231-1 | DEBIAN-CVE-2025-69720 |
| Rocky Linux:10 | ncurses | 0:6.4-15.20240127.el10_1 | RLSA-2026:5913 |
| Ubuntu:22.04:LTS | ncurses | 6.3-2ubuntu0.2 | UBUNTU-CVE-2025-69720 |
| Ubuntu:24.04:LTS | ncurses | 6.4+20240113-1ubuntu2.1 | UBUNTU-CVE-2025-69720 |
| Ubuntu:25.10 | ncurses | 6.5+20250216-2ubuntu0.1 | UBUNTU-CVE-2025-69720 |
Affected products (as reported)
Weakness: CWE-121, CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
References
- https://marc.info/?l=ncurses-bug&m=176539968328570&w=2
- https://marc.info/?l=ncurses-bug&m=176540731801330&w=2
- https://marc.info/?l=ncurses-bug&m=176545557728083&w=2
- https://github.com/Cao-Wuhui/CVE-2025-69720
- https://invisible-island.net/archives/ncurses/6.5/
- https://invisible-island.net/ncurses/
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html