CVE-2025-65411

Low

Published: —Translated: 22/10/2026(UTC)NVD NIST

Summary

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

Risk Assessment

An attacker can crash the unrtf process, causing service unavailability. The risk affects systems processing untrusted input parameters.

Recommendation

Restrict processing of untrusted input by unrtf and consider updating to a patched version. Monitor stability of services using this tool.

Other vulnerabilities in GNU Unrtf

CVE-2025-65410Low
A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

Original NVD description (English source)

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS