CVE-2025-69277
MEDIUM
4,5
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0002
Percentile
0,0th
Updated
EPSS Score Trend (Last 75 Days)
184
Incomplete List of Disallowed Inputs
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html
https://00f.net/2025/12/30/libsodium-vulnerability/
https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc…
https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
https://github.com/pyca/pynacl/issues/920
https://ianix.com/pub/ed25519-deployment.html
https://news.ycombinator.com/item?id=46435614