The vulnerability CVE-2025-69720 affects the infocmp tool in GNU ncurses prior to version 6.5-20251213. It is a stack-based buffer overflow in the analyze_string function located in progs/infocmp.c. The CVSS 3.1 base score is 7.3 (high), with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity, and low impact on availability. This vulnerability could allow an attacker with local access and ability to run infocmp to cause memory corruption potentially leading to code execution or data compromise.

Successful exploitation of this stack-based buffer overflow can lead to unauthorized disclosure or modification of information (high confidentiality and integrity impact). Availability impact is low. Exploitation requires local access and user interaction, limiting remote exploitation potential. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running the infocmp tool with untrusted input. Monitor official GNU ncurses channels for updates and apply the official patch once available.