GHSA-x77x-7mmh-cxv3 Uninitialized memory exposure in string reading functions
Attackers can read uninitialized memory containing sensitive data via string reading functions in the unmaintained ncurses-rs library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-x77x-7mmh-cxv3?
GHSA-x77x-7mmh-cxv3 is a vulnerability in ncurses, published on 21 Oct 2025.
Official description
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
Which versions are affected by GHSA-x77x-7mmh-cxv3?
3 open source packages ship an affected version, including ncurses.
| Package | Affected | Fixed in |
|---|---|---|
ncurses crates.io | All versions to 6.0.1 | None |
ncurses crates.io | All versions to 6.0.1 | None |
ncurses crates.io | From 0.0.0-0 | None |
How do I fix GHSA-x77x-7mmh-cxv3?
No fix has been published for GHSA-x77x-7mmh-cxv3 yet. Limit exposure of the affected software until one is available.
Is GHSA-x77x-7mmh-cxv3 being exploited?
There is no known exploitation of GHSA-x77x-7mmh-cxv3 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0108.