CVE-2025-6966
Null-pointer dereference in python-apt TagSection.keys()
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Null-pointer dereference in python-apt TagSection.keys()
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
CVE-2025-6966- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-201407
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
EUVD-2025-201407- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-285f-828q-q7g5
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a...
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
GHSA-285f-828q-q7g5- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
CVE-2025-6966- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
CVE-2025-6966- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-6966
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
DEBIAN-CVE-2025-6966- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-6966
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
- Record
UBUNTU-CVE-2025-6966- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-7916-1 No score
python-apt vulnerability
Julian Andres Klode discovered that python-apt incorrectly handled deb822 configuration files. An attacker could use this issue to cause python-apt to crash, resulting in a denial of service.
- Record
USN-7916-1- Updated
- 2026-11-02
OSVUSN-7916-2 No score
python-apt regression
USN-7916-1 fixed a vulnerability in python-apt. The update had a PEP 440 incompatible version. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Julian Andres Klode discovered that python-apt incorrectly handled deb822 configuration files. An attacker could use this issue to cause python-apt to crash, resulting in a denial of service.
- Record
USN-7916-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-aptDebian:12 |
All versions, plus listed versions 2.6.02.7.02.7.12.7.22.7.3 Show 17 moreShow less2.7.42.7.52.7.62.7.72.8.02.9.02.9.12.9.22.9.32.9.42.9.52.9.62.9.72.9.82.9.93.0.03.1.0 |
None known |
python-aptDebian:13 |
All versions, plus listed versions 3.0.03.1.0 |
None known |
python-aptDebian:14 |
before 3.1.0, plus listed versions 3.0.0 |
3.1.0 |
python-aptDebian:11 |
before 2.2.1.1, plus listed versions 2.2.1 |
2.2.1.1 |
python-aptUbuntu:Pro:14.04:LTS |
before 0.9.3.5ubuntu3+esm5, plus listed versions 0.8.9.1ubuntu10.9.00.9.10.9.1ubuntu10.9.3.2 Show 11 moreShow less0.9.3.2ubuntu20.9.3.30.9.3.3ubuntu10.9.3.40.9.3.4build10.9.3.50.9.3.5ubuntu10.9.3.5ubuntu20.9.3.5ubuntu30.9.3.5ubuntu3+esm20.9.3.5ubuntu3+esm4 |
0.9.3.5ubuntu3+esm5 |
python-aptUbuntu:Pro:16.04:LTS |
before 1.1.0~beta1ubuntu0.16.04.12+esm1, plus listed versions 1.0.1build11.0.1ubuntu21.1.0~beta11.1.0~beta1build11.1.0~beta1ubuntu0.16.04.1 Show 9 moreShow less1.1.0~beta1ubuntu0.16.04.21.1.0~beta1ubuntu0.16.04.41.1.0~beta1ubuntu0.16.04.51.1.0~beta1ubuntu0.16.04.71.1.0~beta1ubuntu0.16.04.81.1.0~beta1ubuntu0.16.04.91.1.0~beta1ubuntu0.16.04.101.1.0~beta1ubuntu0.16.04.111.1.0~beta1ubuntu0.16.04.12 |
1.1.0~beta1ubuntu0.16.04.12+esm1 |
python-aptUbuntu:Pro:18.04:LTS |
before 1.6.6ubuntu0.1~esm1, plus listed versions 1.4.0~beta3build21.4.0~beta3ubuntu11.6.0~rc2ubuntu11.6.0~rc2ubuntu21.6.0 Show 13 moreShow less1.6.11.6.21.6.31.6.3ubuntu11.6.41.6.5ubuntu0.11.6.5ubuntu0.21.6.5ubuntu0.31.6.5ubuntu0.41.6.5ubuntu0.51.6.5ubuntu0.61.6.5ubuntu0.71.6.6 |
1.6.6ubuntu0.1~esm1 |
python-aptUbuntu:Pro:20.04:LTS |
before 2.0.1ubuntu0.20.04.1+esm1, plus listed versions 1.9.0ubuntu11.9.0ubuntu31.9.0ubuntu51.9.3ubuntu21.9.5 Show 15 moreShow less1.9.5build11.9.71.9.81.9.102.0.02.0.0ubuntu0.20.04.12.0.0ubuntu0.20.04.22.0.0ubuntu0.20.04.32.0.0ubuntu0.20.04.42.0.0ubuntu0.20.04.52.0.0ubuntu0.20.04.62.0.0ubuntu0.20.04.72.0.0ubuntu0.20.04.82.0.12.0.1ubuntu0.20.04.1 |
2.0.1ubuntu0.20.04.1+esm1 |
python-aptUbuntu:22.04:LTS |
before 2.4.0ubuntu4.1, plus listed versions 2.2.12.3.02.3.0ubuntu12.3.0ubuntu22.3.0ubuntu2.1 Show 5 moreShow less2.4.02.4.0ubuntu12.4.0ubuntu22.4.0ubuntu32.4.0ubuntu4 |
2.4.0ubuntu4.1 |
python-aptUbuntu:24.04:LTS |
before 2.7.7ubuntu5.1, plus listed versions 2.6.0ubuntu12.6.0ubuntu22.7.02.7.52.7.6 Show 7 moreShow less2.7.72.7.7build12.7.7ubuntu12.7.7ubuntu22.7.7ubuntu32.7.7ubuntu42.7.7ubuntu5 |
2.7.7ubuntu5.1 |
python-aptUbuntu:25.10 |
before 3.0.0ubuntu1.1, plus listed versions 3.0.03.0.0ubuntu1 |
3.0.0ubuntu1.1 |
python-aptUbuntu:Pro:20.04:LTS |
before 2.0.1ubuntu0.20.04.2esm2, plus listed versions 1.9.0ubuntu11.9.0ubuntu31.9.0ubuntu51.9.3ubuntu21.9.5 Show 16 moreShow less1.9.5build11.9.71.9.81.9.102.0.02.0.0ubuntu0.20.04.12.0.0ubuntu0.20.04.22.0.0ubuntu0.20.04.32.0.0ubuntu0.20.04.42.0.0ubuntu0.20.04.52.0.0ubuntu0.20.04.62.0.0ubuntu0.20.04.72.0.0ubuntu0.20.04.82.0.12.0.1ubuntu0.20.04.12.0.1ubuntu0.20.04.1+esm1 |
2.0.1ubuntu0.20.04.2esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-6966 is a medium vulnerability (CVSS 6.9) in Canonical Python-apt, published December 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in python-apt 3.1.0.