CVE-2025-9820mediumCWE-121

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4epss 0.2%

exploitation probability

0.2%top 88% of all CVEs

observed exploitation

nono source reports it

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

gnutlsRed Hat · Red Hat Ceph Storage 8 Red Hat · Red Hat Discovery 2 Red Hat · Red Hat Enterprise Linux 10 Red Hat · Red Hat Enterprise Linux 6 Red Hat · Red Hat Enterprise Linux 7 Red Hat · Red Hat Enterprise Linux 8 Red Hat · Red Hat Enterprise Linux 9 Red Hat · Red Hat Hardened Images Red Hat · Red Hat Insights proxy 1.5 Red Hat · Red Hat OpenShift Container Platform 4 Red Hat · Red Hat Update Infrastructure 5 Red Hat · RHEL-8 based Middleware Containers

References