CVE-2025-69277

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-184

Affected software

Vendor	Product	Versions
libsodium	libsodium	< ad3004ec8731730e93fcfbbc824e67eadc1c1bae

References

Timeline

Published: Dec 31, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-692787.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-692797.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-692844.3Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so CVE-2025-692856.1SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication CVE-2025-692869.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation al CVE-2025-692875.4The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptograph CVE-2025-692889.1Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeE CVE-2025-692895.4Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and CVE-2025-69298.8A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing CVE-2025-692928.8Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Memb CVE-2025-692938.8Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: f CVE-2025-692948.8Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from