There is a heap-based buffer over-read in the fmtentry function in tinfo/comphash.c in the terminfo library in ncurses before 6.1-20191012.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-17595.json"