CVE catalog

CVE-2025-69720

ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function analyze_string().

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 25, 2026

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ncurses	sid	`6.6+20260608-2`	fixed
Debian	ncurses	forky	`6.6+20260608-2`	fixed
Debian	ncurses	trixie	`6.5+20250216-2`	vulnerable
Debian	ncurses	bookworm	`6.4-4`	vulnerable
Cpe	ncurses	Not reported	Not reported	vulnerable
Ubuntu	ncurses	pro	`6.1+20190803-1ubuntu1`	vulnerable
Ubuntu	ncurses	pro	`6.1+20191019-1ubuntu1`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2.1`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2.1+esm1`	fixed
Ubuntu	ncurses	pro	`6.1+20190803-1ubuntu1`	vulnerable
Ubuntu	ncurses	pro	`6.1+20191019-1ubuntu1`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2.1`	vulnerable
Ubuntu	ncurses	pro	`6.2-0ubuntu2.1+esm1`	fixed
Ubuntu	ncurses	22.04	`6.2+20201114-2build1`	vulnerable
Ubuntu	ncurses	22.04	`6.2+20201114-2build2`	vulnerable
Ubuntu	ncurses	22.04	`6.3-1`	vulnerable
Ubuntu	ncurses	22.04	`6.3-2`	vulnerable
Ubuntu	ncurses	22.04	`6.3-2ubuntu0.1`	vulnerable
Ubuntu	ncurses	22.04	`6.3-2ubuntu0.2`	fixed
Ubuntu	ncurses	24.04	`6.4+20230625-2`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20231016-1`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20231121-1build1`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20231209-1`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20240113-1ubuntu1`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20240113-1ubuntu2`	vulnerable
Ubuntu	ncurses	24.04	`6.4+20240113-1ubuntu2.1`	fixed
Ubuntu	ncurses	25.10	`6.5+20250216-2`	vulnerable
Ubuntu	ncurses	25.10	`6.5+20250216-2build1`	vulnerable
Ubuntu	ncurses	25.10	`6.5+20250216-2ubuntu0.1`	fixed
Suse	ncurses	linux enterprise server 16.0	`6.5.20250531-160000.3.1`	fixed
Suse	ncurses	linux enterprise server for sap applications 16.0	`6.5.20250531-160000.3.1`	fixed
Opensuse	ncurses	leap 16.0	`6.5.20250531-160000.3.1`	fixed
Suse	ncurses	linux micro 6.2	`6.5.20250531-160000.3.1`	fixed
Suse	ncurses	linux micro 6.1	`6.4.20240224-slfo.1.1_2.1`	fixed
Suse	ncurses	linux micro 6.0	`6.4.20240224-11.1`	fixed
Suse	ncurses	linux enterprise micro 5.3	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise micro 5.4	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise micro 5.5	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise module for basesystem 15 sp7	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise module for development tools 15 sp7	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise module for legacy 15 sp7	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise micro 5.2	`6.1-150000.5.33.1`	fixed
Suse	ncurses	linux enterprise server ltss extended security 12 sp5	`5.9-91.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ncurses	source	sid	`6.6+20251231-1`	not yet assigned	Not reported	Not reported
Debian	ncurses	source	forky	`6.6+20251231-1`	not yet assigned	Not reported	Not reported
Debian	ncurses	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	ncurses	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Ubuntu	ncurses	deb	pro	`6.2-0ubuntu2.1+esm1`	Not reported	USN-8503-1	Not reported
Ubuntu	ncurses	deb	pro	`6.2-0ubuntu2.1+esm1`	Not reported	UBUNTU-CVE-2025-69720	Not reported
Ubuntu	ncurses	deb	22.04	`6.3-2ubuntu0.2`	Not reported	UBUNTU-CVE-2025-69720	Not reported
Ubuntu	ncurses	deb	24.04	`6.4+20240113-1ubuntu2.1`	Not reported	UBUNTU-CVE-2025-69720	Not reported
Ubuntu	ncurses	deb	25.10	`6.5+20250216-2ubuntu0.1`	Not reported	UBUNTU-CVE-2025-69720	Not reported
Suse	ncurses	rpm	linux enterprise server 16.0	`6.5.20250531-160000.3.1`	Not reported	SUSE-SU-2026:22294-1	Not reported
Suse	ncurses	rpm	linux enterprise server for sap applications 16.0	`6.5.20250531-160000.3.1`	Not reported	SUSE-SU-2026:22294-1	Not reported
Opensuse	ncurses	rpm	leap 16.0	`6.5.20250531-160000.3.1`	Not reported	OPENSUSE-SU-2026:20992-1	Not reported
Suse	ncurses	rpm	linux micro 6.2	`6.5.20250531-160000.3.1`	Not reported	SUSE-SU-2026:22228-1	Not reported
Suse	ncurses	rpm	linux micro 6.1	`6.4.20240224-slfo.1.1_2.1`	Not reported	SUSE-SU-2026:21261-1	Not reported
Suse	ncurses	rpm	linux micro 6.0	`6.4.20240224-11.1`	Not reported	SUSE-SU-2026:21247-1	Not reported
Suse	ncurses	rpm	linux enterprise micro 5.3	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise micro 5.4	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise micro 5.5	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise module for basesystem 15 sp7	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise module for development tools 15 sp7	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise module for legacy 15 sp7	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise micro 5.2	`6.1-150000.5.33.1`	Not reported	SUSE-SU-2026:1510-1	Not reported
Suse	ncurses	rpm	linux enterprise server ltss extended security 12 sp5	`5.9-91.1`	Not reported	SUSE-SU-2026:1499-1	Not reported

Notes

[trixie] ncurses: Minor issue [bookworm] ncurses: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lib32ncurses6]Affected
Source package: [ncurses]
Details (1)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[lib32ncurses-dev]Affected
Source package: [ncurses]
Details (1)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[lib32ncursesw6]Affected
Source package: [ncurses]
Details (1)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[lib32tinfo6]Affected
Source package: [ncurses]
Details (1)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncurses5]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncurses5-dev]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncurses6]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncurses-dev]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncursesw5]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncursesw5-dev]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libncursesw6]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libtinfo5]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libtinfo6]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[libtinfo-dev]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[ncurses-base]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[ncurses-bin]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[ncurses-doc]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[ncurses-examples]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · amd64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · arm64 · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
[ncurses-term]Affected
Source package: [ncurses]
Details (2)
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12
- 6.4-4 · all · bookworm
  Affected
  nvd · ncurses · debian · bookworm; nvd · ncurses · debian · 12

[Debian 13 (Trixie)]

[lib32ncurses6]Affected
Source package: [ncurses]
Details (1)
- 6.5+20250216-2 · amd64 · trixie
  Affected
  nvd · ncurses · debian · 13

Next results

Observed: Oct 23, 2026, 10:40:20 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]