CVE-2025-9820

A stack‑based buffer overflow was discovered in the GnuTLS library function gnutls_pkcs11_token_init(). When a PKCS#11 token label longer than the expected fixed size is processed, the function writes past the end of the stack buffer, which can crash the application or, under certain conditions, allow arbitrary code execution. The vulnerability is classified as CWE‑121 and can lead to a denial of service or local privilege escalation when used by applications that rely on GnuTLS for encryption services.

Red Hat products that incorporate the vulnerable GnuTLS library are affected. The impacted releases include Red Hat Ceph Storage 8, Red Hat Discovery 2, Red Hat Enterprise Linux 10, 6, 7, 8, 9, Red Hat Hardened Images, Red Hat Insights proxy 1.5, Red Hat OpenShift Container Platform 4, and Red Hat Update Infrastructure 5. No specific minor or patch version ranges are supplied; all instances of the vulnerable library or the affected GnuTLS functions are at risk.

The vulnerability scores a CVSS of 4, indicating moderate severity, while the EPSS score is listed as < 1 % and the flaw is not included in the CISA KEV catalog. The attack vector is most likely local: a user or process with the ability to supply PKCS#11 token labels can trigger the overflow. Exploitation would require successful execution of attacker‑controlled code within the context of the vulnerable application, potentially escalating privileges. Due to the low EPSS probability and lack of remote exposure, the overall immediate risk is moderate but should be mitigated as soon as feasible.