Medium severity · published Dec 5, 2025
CVE-2025-6966
Null-pointer dereference in python-apt TagSection.keys()
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-apt · Canonical
3.0 before 3.0.0ubuntu1.1; 3.0 before 3.0.0ubuntu0.25.04.1; 2.7 before 2.7.7ubuntu5.1; 2.4 before 2.4.0ubuntu4.1; 2.0 before 2.0.1ubuntu0.20.04.1+esm1; 1.6 before 1.6.6ubuntu0.1~esm1; +2 more · source: vendor, NVD
DL
Debian Linux · Debian
11.0 · source: NVD