CVE-2025-9820 is a stack-based buffer overflow vulnerability in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function responsible for PKCS#11 token initialization. When a token label exceeding the expected length is processed, the function writes past the end of a fixed-size stack buffer, potentially causing application crashes or enabling local privilege escalation. This affects systems using GnuTLS on Red Hat Enterprise Linux 10 versions prior to 10.2. Red Hat has issued security advisories and released patched GnuTLS packages (version 3.8.10-3.el10_1 and later) to address this vulnerability.

The vulnerability can cause denial of service through application crashes and may allow local privilege escalation under certain conditions. The CVSS v3.1 score is 4.0 (medium severity) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating local attack vector with low complexity and no required privileges or user interaction. No known exploits in the wild have been reported.

Red Hat has released official security updates for GnuTLS in Red Hat Enterprise Linux 10 that fix this vulnerability. Users should upgrade to the patched GnuTLS packages (e.g., gnutls-3.8.10-3.el10_1 or later) as provided in advisories RHSA-2026:3477 and RHSA-2026:13812. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the vendor-provided patches.