Every CVE Search/ Get API key

CVE-2025-65410

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a...

6.2 MediumFix available

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.23%Up 0.2 points since Dec 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2025-204842 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
EUVD-2025-204842
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h793-prqc-9r54 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a...

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
GHSA-h793-prqc-9r54
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-04
OSVALPINE-CVE-2025-65410 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
ALPINE-CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2025-65410 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
DEBIAN-CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVOESA-2026-1012 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1012
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1013 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1013
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1014 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1014
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1015 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1015
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1016 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1016
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1017 6.2

unrtf security update

UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities

Security Fix(es):

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.(CVE-2025-65410)

Record
OESA-2026-1017
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-65410 6.2

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Record
UBUNTU-CVE-2025-65410
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unrtf
Alpine:v3.24
 before 0.21.13-r0
0.21.13-r0
unrtf
Debian:12
 All versions, plus listed versions
0.21.10-clean-10.21.10-clean-20.21.13-1
 None known
unrtf
Debian:13
 All versions, plus listed versions
0.21.10-clean-10.21.10-clean-20.21.13-1
 None known
unrtf
Debian:14
 All versions, plus listed versions
0.21.10-clean-10.21.10-clean-20.21.13-1
 None known
unrtf
openEuler:22.03-LTS-SP4
 before 0.21.9-2.oe2203sp4
0.21.9-2.oe2203sp4
unrtf
openEuler:24.03-LTS
 before 0.21.9-2.oe2403
0.21.9-2.oe2403
unrtf
openEuler:24.03-LTS-SP1
 before 0.21.9-2.oe2403sp1
0.21.9-2.oe2403sp1
unrtf
openEuler:24.03-LTS-SP2
 before 0.21.9-2.oe2403sp2
0.21.9-2.oe2403sp2
unrtf
openEuler:24.03-LTS-SP3
 before 0.21.9-2.oe2403sp3
0.21.9-2.oe2403sp3
unrtf
openEuler:22.03-LTS-SP3
 before 0.21.9-2.oe2203sp3
0.21.9-2.oe2203sp3
Show 8 moreShow less
Affected packages
PackageAffectedFixed
unrtf
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.21.5-30.21.9-clean-20.21.9-clean-3~build0.16.04.1
 None known
unrtf
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.21.9-clean-3
 None known
unrtf
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.21.10-clean-1
 None known
unrtf
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.21.10-clean-1
 None known
unrtf
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.21.10-clean-1
 None known
unrtf
Ubuntu:25.10
 All versions, plus listed versions
0.21.10-clean-10.21.10-clean-2
 None known
unrtf
Ubuntu:26.10
 All versions, plus listed versions
0.21.10-clean-2build1
 None known
unrtf
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.21.10-clean-20.21.10-clean-2build1
 None known

History

History
RecordedChangedSources
affectedOSV
factsNVD
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-65410 is a medium vulnerability (CVSS 6.2) in Unrtf Project Unrtf, published December 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in unrtf 0.21.13-r0.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open