CVE-2025-69720: 
NixOS vulnerability analysis and mitigation

CVE-2025-69720 is a stack-based buffer overflow vulnerability in the infocmp command-line tool of GNU ncurses, located in the analyze_string() function in progs/infocmp.c. It affects ncurses versions up to and including 6.4, and ncurses 6.5 releases prior to the 20251213 patch. The vulnerability was discovered by Yixuan Cao of Shenzhen University and published on March 19, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub PoC). IBM Cloud Pak for AIOps is also listed as an affected product (IBM Advisory).

The root cause is a classic buffer copy without size validation (CWE-120/CWE-121). When infocmp is invoked with the -i flag, analyze_string() computes len = strlen(cp) and copies the candidate CSI substring into a fixed 4096-byte stack buffer (buf2[MAX_TERMINFO_LENGTH]) via strncpy, without first verifying that len does not exceed 4096. A crafted terminfo entry with an excessively long SGR parameter list (e.g., sgr=\E[1234567;...;m with ~800 parameters) causes a write of 6402 bytes into buf2, overflowing the stack buffer. The -i option specifically triggers analysis of init/reset-related capabilities (is1/is2/is3/rs1/rs2/rs3/smcup/rmcup/smkx/rmkx), and is not triggered by common infocmp usage without this flag. A public PoC with detailed reproduction steps is available on GitHub (GitHub PoC).

Successful exploitation allows a local attacker to trigger a stack-buffer-overflow in the infocmp process, potentially enabling arbitrary code execution with the privileges of the user running infocmp. At minimum, the vulnerability causes a crash (local denial of service for that invocation). Because exploitation requires user interaction (running infocmp -i against a malicious terminfo file), the scope is limited to the local system and the privileges of the invoking user, with high confidentiality, integrity, and availability impact (Red Hat CVE, GitHub PoC).

A public proof-of-concept exploit is available on GitHub, providing step-by-step reproduction instructions including compilation flags, malicious terminfo file creation, and exact command sequences (GitHub PoC). The EPSS score is approximately 0.018% (0.000180), indicating low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and user interaction (the victim must run infocmp -i against a crafted terminfo entry), limiting its practical attack surface (Red Hat CVE).

1. Craft a malicious terminfo source file: Create a terminfo source file (e.g., evil_sgr.ti) containing a terminal entry with an excessively long SGR capability, such as sgr=\E[1234567;1234567;...;m with approximately 800 or more semicolon-separated parameters, exceeding 4096 characters in the CSI parameter list.
2. Compile the malicious terminfo entry: Use the tic utility to compile the crafted source into a terminfo database directory: tic -x -o /tmp/evilti evil_sgr.ti. This creates a binary terminfo entry that infocmp will parse.
3. Trigger the overflow: Invoke infocmp with the -i flag and point it at the malicious terminfo database: TERMINFO=/tmp/evilti infocmp -i evil_sgr. The -i flag causes analyze_string() to process the crafted SGR capability, copying the oversized string into the 4096-byte buf2 stack buffer without bounds checking, overflowing it by approximately 2306 bytes.
4. Achieve code execution or crash: The stack smash overwrites adjacent stack memory including the return address, potentially enabling arbitrary code execution with the privileges of the user running infocmp, or at minimum causing an immediate crash (SIGABRT/SIGSEGV) (GitHub PoC).

• Process: Unexpected crash or abort of the infocmp process, particularly when invoked with the -i flag; core dump files generated by infocmp in the working directory or /var/crash.
• File System: Presence of unusual or unknown terminfo database directories (e.g., under /tmp) containing entries with abnormally large capability strings; files named evil_sgr or similar in terminfo directories.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing infocmp process termination with signal 6 (SIGABRT) or signal 11 (SIGSEGV); AddressSanitizer output referencing stack-buffer-overflow in analyze_string at progs/infocmp.c.
• Environment: Use of the TERMINFO environment variable pointing to non-standard or temporary directories when infocmp -i is executed (GitHub PoC).

Update ncurses to version 6.5-20251213 or later, which contains the official fix confirmed by the ncurses project (marc.info patch). Linux distributions including Red Hat, SUSE, AlmaLinux, Rocky Linux, and Oracle Linux have issued updated packages (Red Hat Advisory). IBM has released a fix for Cloud Pak for AIOps (IBM Advisory). As a workaround where patching is not immediately possible, restrict local user access to the infocmp binary or remove execute permissions for untrusted users, and avoid running infocmp -i against untrusted or externally sourced terminfo files.

Red Hat assigned the vulnerability a High severity rating and issued a security errata (RHSA-2026:5913) for affected RHEL packages (Red Hat Advisory). The Yocto Project security mailing list discussed the vulnerability in the context of embedded Linux distributions (Yocto Security List). German Linux security outlet pro-linux.de covered the vulnerability across multiple advisories for SUSE and other distributions. Community discussion on the Proxmox forum noted the vulnerability appearing in Wazuh vulnerability scans, reflecting broader awareness among system administrators.