Screen

This hub aggregates every CVE we track for Screen, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 14 most recently published vulnerabilities affecting Screen.

• CVE-2025-23395Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set7.8May 26, 2025
• CVE-2025-46802Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen6.0May 26, 2025
• CVE-2025-46803Screen creates by default world-writable PTYs5.0May 26, 2025
• CVE-2025-46804Screen 5.0.0 and older versions allow file existence tests when installed setuid-root3.3May 26, 2025
• CVE-2025-46805Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root5.5May 26, 2025
• CVE-2023-24626socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, ca...6.5Apr 8, 2023
• CVE-2021-26937encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-...9.8Feb 9, 2021
• CVE-2020-9366A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly h...9.8Feb 24, 2020
• CVE-2017-5618GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.7.8Mar 20, 2017
• CVE-2009-1214GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.4.9Apr 1, 2009
• CVE-2007-3048GNU screen 4.0.3 allows local users to unlock the screen via a CTRL-C sequence at the password prompt. NOTE: multiple third parties report inability to reproduce this issue7.2Jun 5, 2007
• CVE-2006-4573Multiple unspecified vulnerabilities in the "utf8 combining characters handling" (utf8_handle_comb function in encoding.c) in screen before 4.0.3 allows user-assisted attackers to cause a denial of...2.6Oct 24, 2006
• CVE-2002-1602Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code.4.6Mar 25, 2005
• CVE-2003-0972Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape ...10.0Dec 2, 2003