CVE-2025-6966 — Null-pointer dereference in python-apt TagSection.keys()

Back Back to CVE browser

MEDIUM

Null-pointer dereference in python-apt TagSection.keys()

Published Dec 5, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.14%

Description

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Affected products

Vendor Canonical Product Python-Apt Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <0.9.3.5ubuntu3+esm5
- Version
  1.1
  Status
  affected
  Constraints
  <1.1.0~beta1ubuntu0.16.04.12+esm1
- Version
  1.6
  Status
  affected
  Constraints
  <1.6.6ubuntu0.1~esm1
- Version
  2.0
  Status
  affected
  Constraints
  <2.0.1ubuntu0.20.04.1+esm1
- Version
  2.4
  Status
  affected
  Constraints
  <2.4.0ubuntu4.1
- Version
  2.7
  Status
  affected
  Constraints
  <2.7.7ubuntu5.1
- Version
  3.0
  Status
  affected
  Constraints
  <3.0.0ubuntu0.25.04.1
- Version
  3.0
  Status
  affected
  Constraints
  <3.0.0ubuntu1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Canonical

Python-Apt

unaffected

Version	Status	Constraints
0	affected	<0.9.3.5ubuntu3+esm5
1.1	affected	<1.1.0~beta1ubuntu0.16.04.12+esm1
1.6	affected	<1.6.6ubuntu0.1~esm1
2.0	affected	<2.0.1ubuntu0.20.04.1+esm1
2.4	affected	<2.4.0ubuntu4.1
2.7	affected	<2.7.7ubuntu5.1
3.0	affected	<3.0.0ubuntu0.25.04.1
3.0	affected	<3.0.0ubuntu1.1

Remediation

Red Hat statement

This vulnerability is rated Low for Red Hat as it requires a local attacker to provide a crafted deb822 file to trigger a NULL pointer dereference in `python-apt`, leading to a denial of service (process crash). Red Hat products that utilize `python-apt` and process untrusted deb822 files may be affected.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Metrics

0.14% 0.00145

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00145

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.14% (0.00145)	3.19th	v5 (v2026.06.15)
Jun 15, 2026	0.12% (0.00122)	2.33th	v5 (v2026.06.15)
Dec 6, 2025	0.01% (0.00014)	1.98th	v4 (v2025.03.14)

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (6)

https://access.redhat.com/security/cve/CVE-2025-6966
Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/2091865
ExploitIssue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2419364
Issue Tracking
https://lists.debian.org/debian-lts-announce/2025/12/msg00019.html
Mailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6966
https://www.cve.org/CVERecord?id=CVE-2025-6966

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-6966		Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/2091865		ExploitIssue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2419364		Issue Tracking
https://lists.debian.org/debian-lts-announce/2025/12/msg00019.html		Mailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6966
https://www.cve.org/CVERecord?id=CVE-2025-6966