CVE-2021-39537: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in ncurses through version 6.2-1, specifically in the nccaptoinfo function in captoinfo.c. The vulnerability was discovered in August 2020 and assigned CVE-2021-39537 in September 2021 (Bug Report, NVD).

The vulnerability exists in the nccaptoinfo function in captoinfo.c where improper bounds checking leads to a heap buffer overflow condition. The issue manifests as a READ operation of size 1 beyond allocated memory boundaries. The vulnerability has a CVSS v3.1 base score of 8.8 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

While initially rated with a high CVSS score, the actual impact appears to be limited to a buffer overread that could lead to application crashes or information disclosure. The vulnerability cannot be exploited for arbitrary code execution as originally thought (Bug Discussion).

The vulnerability was fixed in subsequent releases of ncurses. Various operating system vendors have released patches, including Apple in macOS updates and Debian in security updates. For Debian 10 buster, the fix was included in version 6.1+20181013-2+deb10u5 (Debian Advisory).