CVE Catalog
CVE-2017-10684
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk4.88%
91th percentile - higher than 91% of all known CVEs
Summary
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
Risk Assessment
An attacker can remotely execute code in the context of an application using ncurses, potentially leading to system compromise.
Recommendation
Update the ncurses library to version 6.1 or later, which contains the fix.
Original NVD description (English source)
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.