Vulnerability · Published Feb 9, 2021 · Assigned by mitre
CVE-2021-26937
Critical 9.8
In plain English
A critical-severity security flaw in the screen package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.3% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)9.3%top 4.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | screen | 4.8.0-r4 | ALPINE-CVE-2021-26937 |
| Alpine:v3.21 | screen | 4.8.0-r4 | ALPINE-CVE-2021-26937 |
| Alpine:v3.22 | screen | 4.8.0-r4 | ALPINE-CVE-2021-26937 |
| Alpine:v3.23 | screen | 4.8.0-r4 | ALPINE-CVE-2021-26937 |
| Alpine:v3.24 | screen | 4.8.0-r4 | ALPINE-CVE-2021-26937 |
| Debian:12 | screen | 4.8.0-5 | DEBIAN-CVE-2021-26937 |
| Debian:13 | screen | 4.8.0-5 | DEBIAN-CVE-2021-26937 |
| Debian:14 | screen | 4.8.0-5 | DEBIAN-CVE-2021-26937 |
Affected products (as reported)
References
- https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/02/09/3 x_refsource_MISC
- https://ftp.gnu.org/gnu/screen/ x_refsource_MISC
- [oss-security] 20210210 Re: screen crash processing combining characters mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210219 [SECURITY] [DLA 2570-1] screen security update mailing-list, x_refsource_MLIST
- DSA-4861 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2021-5e9894a0c5 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-9107eeb95c vendor-advisory, x_refsource_FEDORA
- GLSA-202105-11 vendor-advisory, x_refsource_GENTOO
- https://security.netapp.com/advisory/ntap-20250509-0004/