CVE-2025-6141: GNU ncurses parse_entry.c postprocess_termcap stack-based overflow

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-16 · updated 2026-06-17
Weakness: CWE-119

Description

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

Affected products

GNU ncurses: 6.5-20250322

References

https://invisible-island.net/ncurses/NEWS.html#index-t20250329
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html
https://vuldb.com/?ctiid.312610
https://vuldb.com/?id.312610
https://vuldb.com/?submit.593000
https://www.gnu.org/
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Get alerted when CVE-2025-6141 or the next vulnerability affects your stack