PT-2025-25593 · Gnu+1 · Ncurses+1

Jjleo · Published 2025-06-16 · Updated 2026-05-05 · CVE-2025-6141

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions GNU ncurses versions up to 6.5-20250322

Description A stack-based buffer overflow issue has been identified, affecting the postprocess termcap function in the tinfo/parse entry.c file. This issue can be exploited locally.

Recommendations For GNU ncurses versions up to 6.5-20250322, upgrade to version 6.5-20250329 to address this issue. As a temporary workaround, consider restricting access to the postprocess termcap function until the upgrade is applied.

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

AZL-64139

CVE-2025-6141

ECHO-D3C9-C3E9-90E8

JLSEC-2026-454

OESA-2025-1851

Affected Products

Debian

Ncurses

References · 27

• https://osv.dev/vulnerability/AZL-64139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6141 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-6141 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6141 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6141 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-454 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6141 · Vendor Advisory
• https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6141 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-6141 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-6141 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-6141 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6141 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1851 · Vendor Advisory
• https://twitter.com/CVEnew/status/1934742003931033920 · Twitter Post