A stack‑based buffer overflow exists in the analyze_string function of the ncurses infocmp command‑line utility. The flaw allows an attacker to exceed the bounds of a local array and overwrite adjacent stack memory, potentially corrupting control flow and achieving arbitrary code execution. The vulnerability can be exercised by supplying specially crafted arguments to the infocmp program, so the impact is tied to the ability to run the tool with untrusted input.

All GNU ncurses distributions prior to the 6.5‑20251213 release are affected. This includes every 6.5 minor revision issued before December 13, 2025, as well as earlier major releases. The vulnerable code resides in the core ncurses source tree, meaning any operating system or platform that ships ncurses without the patch is susceptible.

The CVSS score of 7.3 reflects a high severity of this flaw, yet the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation in the wild is currently unlikely. Based on the description, it is inferred that the attack vector is local or requires an environment where the infocmp binary is executed with input that can be controlled by an attacker. No public exploits have been reported, but the underlying buffer overflow could be leveraged in a targeted or chain‑based attack if an attacker can trigger the vulnerable path.