CVE-2025-6966

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - security@ubuntu.com

Published

2025-12-05

Last modified

2025-12-15

Weaknesses

CWE-476

Affected products

• Python-apt (Canonical)
• Debian Linux (Debian)
• Python-apt (Ubuntu)

References

• https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/2091865
• https://lists.debian.org/debian-lts-announce/2025/12/msg00019.html