CVE-2025-9820 Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function
A stack-based buffer overflow in GnuTLS allows attackers to cause denial of service or execute arbitrary code via crafted PKCS#11 token labels.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9820?
CVE-2025-9820 is a medium-severity memory corruption vulnerability in Cert Manager support for Red Hat OpenShift release 1.18, published on 26 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
Weakness: CWE-121
Which versions are affected by CVE-2025-9820?
Linux distribution packages (11)
gnutls SUSE:Linux Enterprise Micro 5.2 | All versions | 3.6.7-150200.14.40.1 |
gnutls SUSE:Linux Enterprise Micro 5.3 | All versions | 3.7.3-150400.19.1 |
gnutls SUSE:Linux Enterprise Micro 5.4 | All versions | 3.7.3-150400.4.53.1 |
gnutls SUSE:Linux Enterprise Micro 5.5 | All versions | 3.7.3-150400.4.53.1 |
gnutls SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 3.8.3-150600.4.12.1 |
gnutls SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.8.3-150600.4.12.1 |
gnutls SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.3.27-3.15.1 |
gnutls SUSE:Linux Micro 6.0 | All versions | 3.8.3-5.1 |
gnutls SUSE:Linux Micro 6.1 | All versions | 3.8.3-slfo.1.1_5.1 |
gnutls openSUSE:Leap 15.6 | All versions | 3.8.3-150600.4.12.1 |
gnutls openSUSE:Tumbleweed | All versions | 3.8.11-1.1 |
How do I fix CVE-2025-9820?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9820 being exploited?
There is no known exploitation of CVE-2025-9820 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-9820, AZL-75258, AZL-75261, BELL-CVE-2025-9820, CLSA-2026-1775224602, DEBIAN-CVE-2025-9820 and 17 more.