CVE-2025-6966 — Null-pointer dereference in python-apt TagSection.keys()

Description (CNA)

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Affected (CNA)

Vendor / product	Versions
Canonical / python-apt	affected 3.0 before 3.0.0ubuntu1.1; affected 3.0 before 3.0.0ubuntu0.25.04.1; affected 2.7 before 2.7.7ubuntu5.1; affected 2.4 before 2.4.0ubuntu4.1; affected 2.0 before 2.0.1ubuntu0.20.04.1+esm1; affected 1.6 before 1.6.6ubuntu0.1~esm1; affected 1.1 before 1.1.0~beta1ubuntu0.16.04.12+esm1; affected 0 before 0.9.3.5ubuntu3+esm5

CWE

CWE-476

References

https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/2091865

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.debian.org/debian-lts-announce/2025/12/msg00019.html