Low severity · published Jun 16, 2025
CVE-2025-6141
GNU ncurses parse_entry.c postprocess_termcap stack-based overflow
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
ncurses · GNU
6.5-20250322 · source: vendor
RR
RUGGEDCOM RST2428P · Siemens
before V3.3; before V4.0 · source: CISA
SX
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCH328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM324 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM332 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 12xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 8xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (24 V DC, 12xFO) · Siemens
before V3.3 · source: CISA
In the news
VulnerabilityHigh
Siemens SINEC OS
View CSAF
Summary
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
The following versions of Siemens SINEC OS are affected:
RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375)
SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...
Feb 12, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6141
invisible-island.net
https://invisible-island.net/ncurses/NEWS.html#index-t20250329
lists.gnu.org
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html
lists.gnu.org
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html
lists.gnu.org
https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html
vuldb.com
https://vuldb.com/?ctiid.312610
vuldb.com
https://vuldb.com/?id.312610
More from ncurses
7.8
CVE-2025-69720
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c