CVE-2025-69720

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-69720", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-06-02T13:00:33.095Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-03-19T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ncurses", "vendor": "GNU", "versions": [{"lessThan": "6.5-20251213", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-26T15:08:06.834Z"}, "references": [{"url": "https://marc.info/?l=ncurses-bug&m=176539968328570&w=2"}, {"url": "https://marc.info/?l=ncurses-bug&m=176540731801330&w=2"}, {"url": "https://marc.info/?l=ncurses-bug&m=176545557728083&w=2"}, {"url": "https://github.com/Cao-Wuhui/CVE-2025-69720"}, {"url": "https://invisible-island.net/archives/ncurses/6.5/"}, {"url": "https://invisible-island.net/ncurses/"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:ncurses:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.5-20251213"}]}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T01:05:11.996191Z", "id": "CVE-2025-69720", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T15:32:18.095Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:33.095Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:33.095Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-69720", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T01:05:11.996191Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T01:06:48.727Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"}}], "affected": [{"vendor": "GNU", "product": "ncurses", "versions": [{"status": "affected", "version": "0", "lessThan": "6.5-20251213", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://marc.info/?l=ncurses-bug&m=176539968328570&w=2"}, {"url": "https://marc.info/?l=ncurses-bug&m=176540731801330&w=2"}, {"url": "https://marc.info/?l=ncurses-bug&m=176545557728083&w=2"}, {"url": "https://github.com/Cao-Wuhui/CVE-2025-69720"}, {"url": "https://invisible-island.net/archives/ncurses/6.5/"}, {"url": "https://invisible-island.net/ncurses/"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:ncurses:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5-20251213"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-26T15:08:06.834Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69720", "state": "PUBLISHED", "dateUpdated": "2026-06-02T13:00:33.095Z", "dateReserved": "2026-01-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-19T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ncurses", "vendor": "GNU", "versions": [{"lessThan": "6.5-20251213", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:invisible-island:ncurses:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F833BCF-B5C0-4AD1-8D3D-F32F39D63ABA", "versionEndIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240427:*:*:*:*:*:*", "matchCriteriaId": "01C6DAFD-5194-497F-A396-306919613DA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240504:*:*:*:*:*:*", "matchCriteriaId": "2B59129C-B8AE-4043-9E9A-3340AE9FDE0D", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240511:*:*:*:*:*:*", "matchCriteriaId": "0CB16CE1-D8ED-40D2-917C-3E23769D11A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240518:*:*:*:*:*:*", "matchCriteriaId": "81784D7B-85D5-4570-A2FA-12A6EA2ED29D", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240519:*:*:*:*:*:*", "matchCriteriaId": "30DDED53-9D63-441D-B85A-A5FBAC8F8F0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240525:*:*:*:*:*:*", "matchCriteriaId": "8D6CF1A5-BCC5-4452-ABE3-6AEB2A5C19E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240601:*:*:*:*:*:*", "matchCriteriaId": "95423C26-3583-450A-BDAF-2A3C76959920", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240608:*:*:*:*:*:*", "matchCriteriaId": "E59E117A-7813-4686-8A52-B2A99A45D6F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240615:*:*:*:*:*:*", "matchCriteriaId": "F6B1487C-518E-425D-A89E-32CDF754CD3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240622:*:*:*:*:*:*", "matchCriteriaId": "B0343D0B-8D98-4F15-8166-68012A62CBC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240629:*:*:*:*:*:*", "matchCriteriaId": "FFC1BE47-198C-4B29-938A-D33127B7A758", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240706:*:*:*:*:*:*", "matchCriteriaId": "373EB650-F970-40A5-BD32-09BEE34F48B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240713:*:*:*:*:*:*", "matchCriteriaId": "FCB11782-AE68-4784-BCCC-05817C4D2AE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240720:*:*:*:*:*:*", "matchCriteriaId": "8FFED224-2F31-4877-B469-B8ED88186D4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240727:*:*:*:*:*:*", "matchCriteriaId": "9052908B-E79B-4758-8BB8-D716751B674E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240810:*:*:*:*:*:*", "matchCriteriaId": "94B0EC59-5F4C-4835-B6D3-6646873D9EEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240817:*:*:*:*:*:*", "matchCriteriaId": "568EF5E6-F534-4A64-A17E-0E1C8B58EB3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240824:*:*:*:*:*:*", "matchCriteriaId": "803C48AD-237B-4BF8-8424-BB4ACFCCF001", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240831:*:*:*:*:*:*", "matchCriteriaId": "0D22BA4A-0C03-4679-ABB4-54DCA427E105", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240914:*:*:*:*:*:*", "matchCriteriaId": "D0361067-595F-43B2-AFD8-9BEF6C37785F", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240922:*:*:*:*:*:*", "matchCriteriaId": "62EAEBD3-870E-477C-B9D3-8ED0E7BAF974", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20240928:*:*:*:*:*:*", "matchCriteriaId": "5C173F79-8726-4EE6-8C63-E0756C9AC993", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241006:*:*:*:*:*:*", "matchCriteriaId": "FDCA5EFB-7D8F-4448-8C48-D04C4E5A8D0B", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241019:*:*:*:*:*:*", "matchCriteriaId": "F724BD25-215C-4774-A564-6D41C89B8F6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241026:*:*:*:*:*:*", "matchCriteriaId": "C35CD022-20E1-417D-871A-552570D470C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241102:*:*:*:*:*:*", "matchCriteriaId": "1ACD19D6-1CDC-4C7A-9DBB-A9C441850BEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241109:*:*:*:*:*:*", "matchCriteriaId": "431FBF60-D9BF-434A-B103-CEE445D08F28", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241123:*:*:*:*:*:*", "matchCriteriaId": "7E07FBF9-2D38-4A5E-92E9-6374E1024297", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241130:*:*:*:*:*:*", "matchCriteriaId": "CA0F9B1C-DCB2-473D-8086-D1F35BEDB9C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241207:*:*:*:*:*:*", "matchCriteriaId": "FC35855B-F702-48E9-AD8E-DBE542B29CD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241214:*:*:*:*:*:*", "matchCriteriaId": "920C5FD1-3614-4252-9F19-089CF2FDAF96", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241221:*:*:*:*:*:*", "matchCriteriaId": "C134C17C-AB7D-4182-9D2F-98DE5615ACAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20241228:*:*:*:*:*:*", "matchCriteriaId": "6AAE6560-8BB3-4761-AFA3-6FF4CF3931C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250104:*:*:*:*:*:*", "matchCriteriaId": "786764EE-4C0A-4801-BA0A-6751350E574D", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250111:*:*:*:*:*:*", "matchCriteriaId": "488796C4-88A8-4F62-A9C0-E96DF926C59B", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250118:*:*:*:*:*:*", "matchCriteriaId": "5F8EAFB1-DB1C-4107-987C-12C803F98C9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250125:*:*:*:*:*:*", "matchCriteriaId": "CF4738B1-966C-4999-8DEC-6E3317957664", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250201:*:*:*:*:*:*", "matchCriteriaId": "C2F1AACB-C3DF-4511-A261-B5BA24013645", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250208:*:*:*:*:*:*", "matchCriteriaId": "B9B386A4-D643-4B27-83F2-57ADC2F190C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250215:*:*:*:*:*:*", "matchCriteriaId": "60E7F820-9A4D-48D1-A817-A582CEC9CD54", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250216:*:*:*:*:*:*", "matchCriteriaId": "3D2291EE-1EA4-48E0-9CA6-2A6DD644F4F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250222:*:*:*:*:*:*", "matchCriteriaId": "2E4353C2-22B4-44DB-817F-4BDB385B6DC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250301:*:*:*:*:*:*", "matchCriteriaId": "2CFFF73B-C236-424D-B3A8-B03DE0A3D608", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250308:*:*:*:*:*:*", "matchCriteriaId": "F077FBC1-03F0-48EC-8D1A-91A0D34A526F", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250315:*:*:*:*:*:*", "matchCriteriaId": "BF4DF4F2-C8DC-43E1-A38D-D13C402BAB7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250322:*:*:*:*:*:*", "matchCriteriaId": "D9198719-6C21-4C72-ADAA-C34D47FBCCA4", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250329:*:*:*:*:*:*", "matchCriteriaId": "17C22701-BFF0-4A09-B8B8-2851D34B5DA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250405:*:*:*:*:*:*", "matchCriteriaId": "74FB0A6F-C157-429A-A769-6B5ED94296C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250412:*:*:*:*:*:*", "matchCriteriaId": "70B219DA-5D24-4AA2-9EBA-EDEAE59BBFE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250419:*:*:*:*:*:*", "matchCriteriaId": "A6443172-FB7F-408B-A104-86B98F4FEEE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250426:*:*:*:*:*:*", "matchCriteriaId": "DCE6DEF3-9792-4BF7-AF16-B59DA2CB066A", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250503:*:*:*:*:*:*", "matchCriteriaId": "EB98C70C-02EA-4A97-A475-BC30170C90A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250510:*:*:*:*:*:*", "matchCriteriaId": "166696C0-BC8E-47E5-814B-B8D8AF0F9DBF", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250517:*:*:*:*:*:*", "matchCriteriaId": "49C22417-14A4-4CFB-BAF0-B53F9EA19E8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250524:*:*:*:*:*:*", "matchCriteriaId": "B7642084-2D96-4604-A43B-43C777B243A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250531:*:*:*:*:*:*", "matchCriteriaId": "D80D2BF8-0795-4CA5-B33F-14024FEB9C7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250614:*:*:*:*:*:*", "matchCriteriaId": "2F73803B-F963-4AE5-8A45-01FCFC991D15", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250621:*:*:*:*:*:*", "matchCriteriaId": "CDA61BDD-96FF-42D6-8145-5B4F2D27EB81", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250628:*:*:*:*:*:*", "matchCriteriaId": "4E855110-A534-4035-A52D-AEA00FB46F7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250705:*:*:*:*:*:*", "matchCriteriaId": "BF1013BF-649F-402F-A746-08F51D243384", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250712:*:*:*:*:*:*", "matchCriteriaId": "2DA2CC90-D9C7-47E1-A0CC-C9C8B5692297", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250720:*:*:*:*:*:*", "matchCriteriaId": "F50B46A2-2730-416B-91F9-003A8F31A34E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250726:*:*:*:*:*:*", "matchCriteriaId": "BC9CBD76-49EB-4F2F-B423-C29295383692", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250802:*:*:*:*:*:*", "matchCriteriaId": "A4620E27-7771-4D47-99DD-317CD5051469", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250809:*:*:*:*:*:*", "matchCriteriaId": "1DF12182-D312-4118-8708-38C990D22542", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250816:*:*:*:*:*:*", "matchCriteriaId": "AF1E3C6A-F963-4B32-A7AA-DFB7D60775DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250823:*:*:*:*:*:*", "matchCriteriaId": "5152E3B8-6B07-455A-9A1F-ED564EF41C66", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250830:*:*:*:*:*:*", "matchCriteriaId": "CC15F32E-9F0B-4268-B487-621249016034", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250913:*:*:*:*:*:*", "matchCriteriaId": "7E4F453B-6948-4E87-AEA6-19AC85DEF3DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250920:*:*:*:*:*:*", "matchCriteriaId": "47A4E2C3-38DF-4E0C-9C99-F27258D5F46D", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20250927:*:*:*:*:*:*", "matchCriteriaId": "47BECB6C-23E4-41B1-889A-FDEEB36A658E", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251004:*:*:*:*:*:*", "matchCriteriaId": "F686C3CA-4EEA-412A-BC2D-C491FE5C3216", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251010:*:*:*:*:*:*", "matchCriteriaId": "EFC895B9-95C1-4DBF-9FAF-46DB073D1D84", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251018:*:*:*:*:*:*", "matchCriteriaId": "FD76C797-9CCD-4435-BD0B-4BDC635D18F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251025:*:*:*:*:*:*", "matchCriteriaId": "8FBA0671-FCA3-4EBC-BF88-6EEDF94A55B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251101:*:*:*:*:*:*", "matchCriteriaId": "924191D6-7FC1-49FB-BE3C-C788B7EFD031", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251115:*:*:*:*:*:*", "matchCriteriaId": "F6CF94C0-97BF-4370-AF63-2673C99F9835", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251122:*:*:*:*:*:*", "matchCriteriaId": "9DE8A0A0-74CF-4850-9974-681BC8EAF606", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251123:*:*:*:*:*:*", "matchCriteriaId": "9D5CA575-EDE5-4E42-B465-284C4B9BD822", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251129:*:*:*:*:*:*", "matchCriteriaId": "ACA7CB1C-8F84-497E-A48E-E975D625CD43", "vulnerable": true}, {"criteria": "cpe:2.3:a:invisible-island:ncurses:6.5:20251206:*:*:*:*:*:*", "matchCriteriaId": "46993193-F710-4CBF-AA5A-3218E2A53BC6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}, {"lang": "es", "value": "ncurses v6.5 y v6.4 son vulnerables a desbordamiento de b\u00fafer en progs/infocmp.c, funci\u00f3n analyze_string()."}], "id": "CVE-2025-69720", "lastModified": "2026-06-17T10:00:50.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69720", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T01:05:11.996191Z", "version": "2.0.3"}}]}, "published": "2026-03-19T15:16:21.293", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Cao-Wuhui/CVE-2025-69720"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://invisible-island.net/archives/ncurses/6.5/"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://invisible-island.net/ncurses/"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://marc.info/?l=ncurses-bug&m=176539968328570&w=2"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://marc.info/?l=ncurses-bug&m=176540731801330&w=2"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://marc.info/?l=ncurses-bug&m=176545557728083&w=2"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "cve@mitre.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "id": "2449037", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449037"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["A flaw was found in ncurses. This vulnerability, a buffer overflow, exists within the `analyze_string()` function. An attacker could potentially exploit this to execute unauthorized code on the affected system, which might lead to a denial of service in the affected application, the corruption of data, or sensitive information being revealed to an attacker."], "name": "CVE-2025-69720", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ncurses", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "ncurses", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ncurses", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ncurses", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ncurses", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-03-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-69720\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-69720\nhttps://github.com/Cao-Wuhui/CVE-2025-69720\nhttps://marc.info/?l=ncurses-bug&m=176539968328570&w=2\nhttps://marc.info/?l=ncurses-bug&m=176540731801330&w=2\nhttps://marc.info/?l=ncurses-bug&m=176545557728083&w=2"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "ncurses", "vendor": "gnu"}], "analysis": {"en": {"generated_at": "2026-03-26T21:00:29.340009+00:00", "value": {"mitigation_remediation": ["Upgrade ncurses to version 6.5\u201120251213 or later, which removes the vulnerable code.", "If an immediate upgrade is infeasible, restrict execution of the infocmp binary to privileged users or disable the executable altogether.", "Verify that the installed ncurses package matches the patched version by checking the package manager\u2019s metadata or a trusted checksum.", "Monitor system logs for unusual invocations of infocmp and review access controls if suspicious activity is detected.", "Stay informed about future ncurses releases or backport advisories from the maintainers."], "summary": {"action": "Immediate Patch", "impact": "Possible Code Execution via Stack Overflow"}, "threat_synthesis": {"affected_systems": "All GNU ncurses distributions prior to the 6.5\u201120251213 release are affected. This includes every 6.5 minor revision issued before December\u202f13,\u202f2025, as well as earlier major releases. The vulnerable code resides in the core ncurses source tree, meaning any operating system or platform that ships ncurses without the patch is susceptible.", "description_and_impact": "A stack\u2011based buffer overflow exists in the analyze_string function of the ncurses infocmp command\u2011line utility. The flaw allows an attacker to exceed the bounds of a local array and overwrite adjacent stack memory, potentially corrupting control flow and achieving arbitrary code execution. The vulnerability can be exercised by supplying specially crafted arguments to the infocmp program, so the impact is tied to the ability to run the tool with untrusted input.", "risk_and_exploitability": "The CVSS score of 7.3 reflects a high severity of this flaw, yet the EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting that exploitation in the wild is currently unlikely. Based on the description, it is inferred that the attack vector is local or requires an environment where the infocmp binary is executed with input that can be controlled by an attacker. No public exploits have been reported, but the underlying buffer overflow could be leveraged in a targeted or chain\u2011based attack if an attacker can trigger the vulnerable path."}}}}, "created": "2026-03-20T08:58:08.933050+00:00", "updated": "2026-03-27T08:41:49.984465+00:00", "vendors": ["gnu", "gnu$PRODUCT$ncurses"]}