CVE-2023-29491

A vulnerability was found in ncurses and occurs when used by a setuid application. This flaw allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

The impact of this CVE is rated Moderate for several reasons which make it difficult to exploit or limited consequences:

• The only outcome is memory corruption possibly leading to a crash
• There is no trace of privilege escalation
• It cannot be triggered remotely, an attacker must have local access

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.