Vulnerability HighRUSTSEC-2019-0006 · ncurses
RUSTSEC-2019-0006: Buffer overflow and format vulnerabilities in functions exposed without unsafe
Short answerA security vulnerability in the ncurses crate: Buffer overflow and format vulnerabilities in functions exposed without unsafe. GitHub rates it High. No fixed version: replace the crate or remove the affected code path.
| Crate | ncurses |
|---|---|
| Type | Vulnerability |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2019-06-15 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2019-15547, CVE-2019-15548, GHSA-32v7-ghpr-c8hg, GHSA-g7r5-x7cr-vm3v |
| Affected functions | ncurses::instr, ncurses::mvprintw, ncurses::mvwinstr, ncurses::mvwprintw, ncurses::printw |
What to do
- Find who pulls it in:
cargo tree -i ncurses. - Avoid the affected API (
ncurses::instr,ncurses::mvprintw,ncurses::mvwinstr,ncurses::mvwprintw,ncurses::printw), or replace the crate.
Details from the advisory
ncurses exposes functions from the ncurses library which:
- Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (
instr,mvwinstr, etc) - Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the
printwfamily).
References
- Package: crates.io/crates/ncurses
- Advisory: rustsec.org/advisories/RUSTSEC-2019-0006.html
- Report: github.com/RustSec/advisory-db/issues/106
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for ncurses
Up next
Same cratencurses: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?