Screen
14 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Screen, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Screen CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 5 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High3
- Medium6
- Low2
Latest CVEs
The 14 most recently published vulnerabilities affecting Screen.
- CVE-2025-23395Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set7.8
- CVE-2025-46802Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen6.0
- CVE-2025-46803Screen creates by default world-writable PTYs5.0
- CVE-2025-46804Screen 5.0.0 and older versions allow file existence tests when installed setuid-root3.3
- CVE-2025-46805Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root5.5
- CVE-2023-24626socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, ca...6.5
- CVE-2021-26937encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-...9.8
- CVE-2020-9366A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly h...9.8
- CVE-2017-5618GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.7.8
- CVE-2009-1214GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.4.9
- CVE-2007-3048GNU screen 4.0.3 allows local users to unlock the screen via a CTRL-C sequence at the password prompt. NOTE: multiple third parties report inability to reproduce this issue7.2
- CVE-2006-4573Multiple unspecified vulnerabilities in the "utf8 combining characters handling" (utf8_handle_comb function in encoding.c) in screen before 4.0.3 allows user-assisted attackers to cause a denial of...2.6
- CVE-2002-1602Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code.4.6
- CVE-2003-0972Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape ...10.0
Product grouping is registry-driven, with AI assist and human review. How it works