CVE-2025-65411
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to...
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-205834
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
EUVD-2025-205834- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cfg2-4jfq-43g5
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to...
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
GHSA-cfg2-4jfq-43g5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-65411
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
ALPINE-CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2025-65411
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
DEBIAN-CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3550
unrtf security update
UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities
Security Fix(es):
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.(CVE-2025-65411)
- Record
OESA-2026-3550- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3551
unrtf security update
UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities
Security Fix(es):
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.(CVE-2025-65411)
- Record
OESA-2026-3551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3552
unrtf security update
UnRTF is a command-line program written in C which converts documents in Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text's font, size, weight (bold), and slant (italic) * Underlines and strikethroughs * Partial support for text shadowing, outlining, embossing, or engraving * Capitalizations * Superscripts and subscripts * Expanded and condensed text * Changes in the foreground and background colors * Conversion of special characters to HTML entities
Security Fix(es):
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.(CVE-2025-65411)
- Record
OESA-2026-3552- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-65411
A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
- Record
UBUNTU-CVE-2025-65411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unrtfAlpine:v3.24 |
before 0.21.13-r0 | 0.21.13-r0 |
unrtfDebian:12 |
All versions, plus listed versions 0.21.10-clean-10.21.10-clean-2 |
None known |
unrtfDebian:13 |
All versions, plus listed versions 0.21.10-clean-10.21.10-clean-2 |
None known |
unrtfDebian:14 |
All versions, plus listed versions 0.21.10-clean-10.21.10-clean-2 |
None known |
unrtfopenEuler:22.03-LTS-SP4 |
before 0.21.9-2.oe2203sp4 | 0.21.9-2.oe2203sp4 |
unrtfopenEuler:24.03-LTS-SP1 |
before 0.21.9-2.oe2403sp1 | 0.21.9-2.oe2403sp1 |
unrtfopenEuler:24.03-LTS-SP3 |
before 0.21.9-2.oe2403sp3 | 0.21.9-2.oe2403sp3 |
unrtfUbuntu:16.04:LTS |
All versions, plus listed versions 0.21.5-30.21.9-clean-20.21.9-clean-3~build0.16.04.1 |
None known |
unrtfUbuntu:18.04:LTS |
All versions, plus listed versions 0.21.9-clean-3 |
None known |
unrtfUbuntu:20.04:LTS |
All versions, plus listed versions 0.21.10-clean-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
unrtfUbuntu:22.04:LTS |
All versions, plus listed versions 0.21.10-clean-1 |
None known |
unrtfUbuntu:24.04:LTS |
All versions, plus listed versions 0.21.10-clean-1 |
None known |
unrtfUbuntu:25.10 |
All versions, plus listed versions 0.21.10-clean-10.21.10-clean-2 |
None known |
unrtfUbuntu:26.10 |
All versions, plus listed versions 0.21.10-clean-2build1 |
None known |
unrtfUbuntu:26.04:LTS |
All versions, plus listed versions 0.21.10-clean-20.21.10-clean-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-65411 is a high vulnerability (CVSS 7.5) in Unrtf Project Unrtf, published December 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in unrtf 0.21.13-r0.
References
gnu.org/software/unrtf
savannah.gnu.org/projects/unrtf
lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html
sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c
github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md
nvd.nist.gov/vuln/detail/CVE-2025-65411
Show 9 moreShow less
security.alpinelinux.org/vuln/CVE-2025-65411
security-tracker.debian.org/tracker/CVE-2025-65411
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3550
ubuntu.com/security/CVE-2025-65411
cve.org/CVERecord?id=CVE-2025-65411
hg.savannah.gnu.org/hgweb/unrtf/rev/755925d817fe