Local privilege escalation via terminfo heap overflow

Out-of-bounds writes in ncurses before 6.4 20230408 allow local users to elevate privileges through a crafted terminfo database file. The _nc_read_termtype parser reallocates ptr->Strings to a smaller buffer, then uses attacker-controlled string counts to append extended entries beyond that buffer. Exploitation requires a setuid program that honors TERMINFO, TERM, or HOME-derived terminfo paths; a successful multi-stage chain runs code in the program's elevated context.