GitHub Advisoryadvisory · crates.io

GHSA-x77x-7mmh-cxv3 ncurses exposes uninitialized memory in string reading functions

MEDIUM Published 2025-10-22 Modified 2025-10-22 Official page ↗
Ecosystem
crates.io
Packages
ncurses
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-125
Reviewed
2025-10-22

Affected packages

• crates.io ncurses: <= 6.0.1 (no fix yet)

Description

Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found. This allows reading uninitialized memory which may contain sensitive data from previous allocations. The ncurses-rs repository is archived and unmaintained.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References