CVE-2025-65410 Denial of service in n/a

Medium 6.2 Published 23 Dec 2025 Updated 30 Dec 2025

Attackers can cause a denial of service in GNU Unrtf by injecting crafted input into the filename parameter, leading to a stack overflow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-65410?

CVE-2025-65410 is a medium-severity denial of service vulnerability in n/a, published on 23 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Weakness: CWE-121

Which versions are affected by CVE-2025-65410?

It affects 1 product.

Products include Unrtf Project Unrtf.

How do I fix CVE-2025-65410?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-65410 being exploited?

There is no known exploitation of CVE-2025-65410 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-65410, GHSA-h793-prqc-9r54, OESA-2026-1012, OESA-2026-1013, OESA-2026-1014, OESA-2026-1015 and 3 more.