The vulnerability CVE-2025-69720 affects GNU ncurses's infocmp tool prior to version 6.5-20251213. It is a stack-based buffer overflow located in the analyze_string function in the source file progs/infocmp.c. The CVSS 3.1 score is 7.3, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity, and low impact on availability. No known exploits in the wild have been reported. The vulnerability could allow an attacker with local access to execute arbitrary code or cause memory corruption by providing crafted input to infocmp.

Successful exploitation can lead to high confidentiality and integrity impact, potentially allowing arbitrary code execution or unauthorized data manipulation. The availability impact is low. The vulnerability requires local access and user interaction, limiting remote exploitation possibilities. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor GNU ncurses advisories for updates. Until a patch is available, avoid running infocmp with untrusted input or restrict access to trusted users only.