A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
References
| Link | Resource |
|---|---|
| https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md | Exploit Third Party Advisory |
| https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html | Mailing List |
| https://savannah.gnu.org/projects/unrtf/ | Product |
| https://sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c/#L661 | Product |
| https://www.gnu.org/software/unrtf/ | Product |
| https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md | Exploit Third Party Advisory |
Configurations
History
09 Jan 2026, 19:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Unrtf Project unrtf
Unrtf Project |
|
| CPE | cpe:2.3:a:unrtf_project:unrtf:0.21.10:*:*:*:*:*:*:* | |
| References | () https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md - Exploit, Third Party Advisory | |
| References | () https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html - Mailing List | |
| References | () https://savannah.gnu.org/projects/unrtf/ - Product | |
| References | () https://sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c/#L661 - Product | |
| References | () https://www.gnu.org/software/unrtf/ - Product |
02 Jan 2026, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md - | |
| CWE | CWE-476 |
30 Dec 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-30 18:15
Updated : 2026-01-09 19:47
NVD link : CVE-2025-65411
Mitre link : CVE-2025-65411
CVE.ORG link : CVE-2025-65411
JSON object : View
Products Affected
unrtf_project
- unrtf
CWE
CWE-476
NULL Pointer Dereference