Security readout for executives and security teams
Plain-English summary
CVE-2025-69720 is reported as a critical stack buffer overflow in the ncurses infocmp command-line tool. If relevant systems process untrusted terminal capability data, the impact could be severe. The bundle does not prove active exploitation or provide complete downstream package impact.
Executive priority
Prioritize assessment and vendor patch tracking because the CVSS impact is critical and ncurses is widely distributed. Do not assume emergency incident response unless internal exposure or active exploitation evidence is found.
Technical view
The CVE describes a stack-based buffer overflow in analyze_string within progs/infocmp.c in ncurses before 6.5-20251213. It is mapped to CWE-120 and CWE-121 with CVSS 3.1 score 9.8. The affected data in the bundle is inconsistent, listing GNU ncurses with defaultStatus unaffected.
Likely exposure
Exposure is most likely on Unix-like systems where ncurses infocmp is installed and can be run against untrusted or attacker-controlled terminfo data. Because ncurses is commonly packaged by operating-system vendors, confirm impact through distribution and product advisories, including the cited Siemens advisory where applicable.
Exploitation context
The source bundle marks KEV as false. A public GitHub reference exists, but the supplied evidence does not establish active exploitation, exploitation maturity, or real-world targeting. Treat public references as a reason to validate quickly, not proof of exploitation.
Researcher notes
Key uncertainty is affected-version interpretation: the narrative says ncurses before 6.5-20251213, while the affected block lists version 0 and defaultStatus unaffected. Validate against upstream ncurses discussion, CVE JSON, and distribution advisories before declaring fleet exposure.
Mitigation direction
- Check operating-system and product vendor advisories for ncurses updates addressing CVE-2025-69720.
- Update affected ncurses packages when vendor-confirmed fixed packages are available.
- Avoid running infocmp on untrusted terminfo inputs until vendor guidance is applied.
- Track Siemens and upstream ncurses references for product-specific remediation guidance.
Validation and detection
- Inventory systems and containers with ncurses or infocmp installed.
- Compare installed ncurses versions against vendor advisories and the before-6.5-20251213 boundary.
- Review automation or support workflows that invoke infocmp on external data.
- Confirm whether relevant Siemens products are covered by SSA-253495.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-69720 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L1.85.5mitreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://marc.info/?l=ncurses-bug&m=176539968328570&w=2CVE reference, mitre
- https://marc.info/?l=ncurses-bug&m=176540731801330&w=2CVE reference, mitre
- https://marc.info/?l=ncurses-bug&m=176545557728083&w=2CVE reference, mitre
- https://github.com/Cao-Wuhui/CVE-2025-69720CVE reference, mitre
- https://invisible-island.net/archives/ncurses/6.5/CVE reference, mitre
- https://invisible-island.net/ncurses/CVE reference, mitre
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.