CVE-2020-9366 — screen: Out of bounds access when setting w_xtermosc after OSC 49

Back Back to CVE browser

CRITICAL

screen: Out of bounds access when setting w_xtermosc after OSC 49

Published Feb 24, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.71%

Description

A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.

Affected products

Red Hat Enterprise Linux 5

screen

Not affected
Red Hat Enterprise Linux 6

screen

Not affected
Red Hat Enterprise Linux 7

screen

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	screen	Not affected	n/a
Red Hat Enterprise Linux 6	screen	Not affected	n/a
Red Hat Enterprise Linux 7	screen	Not affected	n/a

Remediation

Red Hat statement

It is believed that the vulnerability was caused by upstream commit c5db181. GNU screen versions prior to 4.7.0 do not seem to be impacted.

Metrics

2.71% 0.02706

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02706

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.71% (0.02706)	85.44th	v5 (v2026.06.15)
Jun 15, 2026	2.64% (0.02640)	83.54th	v5 (v2026.06.15)
Mar 30, 2025	0.73% (0.00729)	70.34th	v4 (v2025.03.14)
Mar 29, 2025	2.64% (0.02636)	76.14th	v4 (v2025.03.14)
Jul 20, 2024	0.43% (0.00426)	74.60th	v3 (v2023.03.01)
Feb 14, 2024	0.43% (0.00426)	73.68th	v3 (v2023.03.01)
Dec 29, 2023	0.43% (0.00426)	71.68th	v3 (v2023.03.01)
Dec 14, 2023	0.40% (0.00396)	70.58th	v3 (v2023.03.01)
Mar 7, 2023	0.33% (0.00332)	66.47th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Sep 10, 2022	1.02% (0.01018)	38.88th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	15.35% (0.15351)	91.59th	v2 (v2022.01.01)
Feb 3, 2022	3.71% (0.03706)	72.25th	v1
Jan 6, 2022	3.71% (0.03706)	72.01th	v1
Sep 1, 2021	0.85% (0.00850)	58.29th	v1
Apr 14, 2021	0.85% (0.00850)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-787

Out-of-bounds Write

References (8)

http://www.openwall.com/lists/oss-security/2020/02/25/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-9366
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1801405
Issue Tracking
https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html
x_refsource_MISCMailing ListPatchRelease NotesVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9366
https://security.gentoo.org/glsa/202003-62
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-9366
https://www.openwall.com/lists/oss-security/2020/02/06/3
x_refsource_MISCMailing ListPatchRelease Notes

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/02/25/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-9366		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1801405		Issue Tracking
https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html		x_refsource_MISCMailing ListPatchRelease NotesVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9366
https://security.gentoo.org/glsa/202003-62		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-9366
https://www.openwall.com/lists/oss-security/2020/02/06/3		x_refsource_MISCMailing ListPatchRelease Notes