Unsound MediumRUSTSEC-2025-0108 · ncurses
RUSTSEC-2025-0108: Uninitialized memory exposure in string reading functions
Short answerncurses has an API that can cause undefined behaviour from safe code: Uninitialized memory exposure in string reading functions. No fixed version yet.
| Crate | ncurses |
|---|---|
| Type | Unsound (memory-exposure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2025-10-21 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-x77x-7mmh-cxv3 |
| Affected functions | ncurses::inchnstr, ncurses::inchstr, ncurses::innstr, ncurses::mvwinchnstr, ncurses::mvwinchstr, ncurses::mvwinnstr, ncurses::winchnstr, ncurses::winchstr, ncurses::winnstr, ncurses::winstr |
What to do
- Find who pulls it in:
cargo tree -i ncurses. - Avoid the affected API (
ncurses::inchnstr,ncurses::inchstr,ncurses::innstr,ncurses::mvwinchnstr,ncurses::mvwinchstr,ncurses::mvwinnstr), or replace the crate.
Details from the advisory
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found.
This allows reading uninitialized memory which may contain sensitive data from previous allocations.
The ncurses-rs repository is archived and unmaintained.
References
- Package: crates.io/crates/ncurses
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0108.html
- Web: github.com/RustSec/advisory-db/pull/2427
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for ncurses
Up next
Same cratencurses: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?