GHSA-x77x-7mmh-cxv3: Ncurses Ncurses Exposes Uninitialized Memory Vulnerability

MODERATE
Share
CWE-125
Published
Advisory Summary

GHSA-x77x-7mmh-cxv3 is a MODERATE ncurses exposes uninitialized memory vulnerability (CWE-125: Out-of-bounds Read) affecting Ncurses libraries in the crates.io ecosystem. The issue involves ncurses exposes uninitialized memory in string reading functions. Remediation is available in the latest vendor maintenance releases.

GHSA-x77x-7mmh-cxv3 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-x77x-7mmh-cxv3
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Ncurses
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-x77x-7mmh-cxv3

To remediate this vulnerability, upgrade all affected Ncurses dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ncurses fixed: Latest secure release 
Upgrade ncurses to Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for ncurses

How to Check if You Are Affected

To determine whether your application is affected by GHSA-x77x-7mmh-cxv3, inspect your project dependencies for Ncurses:

inspect dependencies for ncurses

Analyze the terminal output to locate any version of Ncurses in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Ncurses, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found. This allows reading uninitialized memory which may contain sensitive data from previous allocations. The ncurses-rs repository is archived and unmaintained.

GHSA-x77x-7mmh-cxv3 Affected Ncurses Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
ncurses
 crates.io
≤ 6.0.1

References

Ncurses Source Repository REPOSITORY
https://github.com/RustSec/advisory-db/pull/2427
Ncurses Source Repository REPOSITORY
https://github.com/jeaye/ncurses-rs
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2025-0108.html

Frequently Asked Questions

What is GHSA-x77x-7mmh-cxv3?
GHSA-x77x-7mmh-cxv3 is a security vulnerability in Ncurses involving ncurses exposes uninitialized memory in string reading functions under CWE-125: Out-of-bounds Read.
Which Ncurses versions are affected?
Affected versions include releases prior to current release patches across affected packages: ncurses.
What version fixes GHSA-x77x-7mmh-cxv3?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is ncurses affected?
Yes, ncurses is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with GHSA-x77x-7mmh-cxv3?
GHSA-x77x-7mmh-cxv3 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check crates.io dependencies for GHSA-x77x-7mmh-cxv3?
Run the dependency tree command: 'inspect dependencies for ncurses'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x77x-7mmh-cxv3",
  "modified" : "2025-10-22T17:08:50Z",
  "published" : "2025-10-22T17:08:50Z",
  "aliases" : [ ],
  "summary" : "ncurses exposes uninitialized memory in string reading functions",
  "details" : "Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.\n\nThis allows reading uninitialized memory which may contain sensitive data from previous allocations.\n\nThe ncurses-rs repository is archived and unmaintained.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "ncurses"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "6.0.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/RustSec/advisory-db/pull/2427"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jeaye/ncurses-rs"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2025-0108.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-22T17:08:50Z",
    "nvd_published_at" : null
  }
}