GHSA-x77x-7mmh-cxv3
ncurses exposes uninitialized memory in string reading functions
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
ncurses exposes uninitialized memory in string reading functions
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
- Record
GHSA-x77x-7mmh-cxv3- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
ncurses exposes uninitialized memory in string reading functions
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
- Record
GHSA-x77x-7mmh-cxv3- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0108No score
Uninitialized memory exposure in string reading functions
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
- Record
RUSTSEC-2025-0108- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-x77x-7mmh-cxv3 is a medium vulnerability (CVSS 5.5) in ncurses, published October 21, 2025. No source lists public exploit code. No source names a fixed version.