CVE-2025-6141

What it actually does

Stack-based buffer overflow in postprocess_termcap within tinfo/parse_entry.c caused by malformed termcap data manipulation.

Why it matters to the business

Local denial-of-service crashes in terminal-handling applications on systems using affected ncurses packages, with limited operational disruption due to low severity and local-only access requirement.

How an attack unfolds

A local attacker supplies crafted termcap input that triggers an overflow during parsing in the vulnerable function, leading to application instability; no widespread exploitation or threat actor activity observed given low EPSS and absence from KEV.

How to fix it

Upgrade GNU ncurses to 6.5-20250329; for Mageia 5 apply libssh package update to 0.6.5-1.1.mga5.

How to confirm the fix worked

Confirm installed ncurses version meets or exceeds 6.5-20250329 and test termcap parsing with boundary inputs for stability.

Typical attack path

1. Obtain local system access
2. Craft malicious termcap entry targeting postprocess_termcap
3. Invoke an ncurses-using application to trigger parsing and overflow

How to detect it

Review system and application logs for ncurses-related crashes or segmentation faults following termcap processing; correlate with local user activity around affected binaries.

What your security team should do

• Apply the specified ncurses and dependent package upgrades promptly
• Restrict local user influence over termcap files where feasible
• Track ecosystem dependents for downstream impact