Stack-based Buffer Overflow in ncurses infocmp analyze_string

This repository is a minimal proof-of-concept for CVE-2025-69720, a stack-based buffer overflow in ncurses infocmp when the -i option analyzes crafted terminfo strings. The repository contains only two files: a README documenting the vulnerability, affected versions, reproduction steps, and ASan crash evidence; and evil_sgr.ti, the actual malicious terminfo source used as the exploit input. There is no standalone executable exploit script or framework integration. The exploit capability is local and data-driven: the attacker supplies a specially crafted terminfo entry whose sgr capability contains an extremely long CSI parameter list. After compiling this file with tic into a terminfo database and pointing TERMINFO to that database, running infocmp -i evil_sgr causes infocmp's analyze_string() routine to copy an overlong substring into a fixed-size 4096-byte stack buffer (buf2) without validating strlen(cp). The demonstrated result is a reproducible stack-buffer overflow and process abort under ASan, consistent with local denial of service. The README explicitly notes that the vulnerable path is specific to the -i analysis option and does not affect ordinary infocmp usage without -i. Repository structure is straightforward: README.md serves as the advisory and usage guide, while evil_sgr.ti is the core PoC artifact and effective entry point. No network communication, command-and-control behavior, persistence, or post-exploitation payloads are present. The only notable observables are local file paths, TERMINFO usage, and reference URLs for source tarballs, vendor news, and the official patch.