Critical Security Update for ncurses: Addressing CVE-2025-69720
Summary
RHSA-2026:26357: Red Hat Security Advisory: ncurses security update. Affects ncurses versions < 0:6.4-14.20240127.el10_0.1. Fixed in 0:6.4-14.20240127.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ncurses is a widely used library that provides functions to create text-based user interfaces in a terminal. It is essential for applications that require a graphical interface in a command-line environment. The library supports various terminal types and allows developers to manage multiple windows, colors, and keyboard inputs. However, vulnerabilities in ncurses can lead to severe security risks, potentially allowing unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability identified as CVE-2025-69720 in ncurses arises from improper handling of certain input sequences, which can be exploited by attackers to execute arbitrary code or cause a denial of service. This issue can severely compromise the integrity and confidentiality of the system, especially in environments where ncurses is utilized for critical applications. The potential ramifications include unauthorized access to sensitive data and disruption of service.
How To Fix
Minimum fixed version
0:6.4-14.20240127.el10_0.1
This is the first release that contains the fix.
sudo dnf update ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the affected applications or using alternative libraries that do not exhibit this vulnerability until the update can be applied.
Conclusion
The ncurses library has a critical vulnerability (CVE-2025-69720) that poses significant security risks. It is essential to update to the patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for ncurses →
FAQ
CVE-2025-69720 is a security vulnerability in the ncurses library that can lead to arbitrary code execution or denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without signing up.
The CVSS score for this vulnerability is 7.8, indicating a high severity level that requires prompt attention.
If an immediate update is not possible, consider implementing access restrictions to the affected applications or using alternative libraries until the update can be applied.
More details can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:26357.json.
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
