Vulnerability · Published May 26, 2025 · Assigned by suse

CVE-2025-23395Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set

High 7.8

In plain English

A high-severity security flaw in screen. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path. This allows unprivileged users to create files in arbitrary locations with `root` ownership, the invoking user's (real) group ownership and file mode 0644. All data written to the Screen PTY will be logged into this file, allowing to escalate to root privileges

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.21	screen	5.0.1-r0	ALPINE-CVE-2025-23395
Alpine:v3.22	screen	5.0.1-r0	ALPINE-CVE-2025-23395
Alpine:v3.23	screen	5.0.1-r0	ALPINE-CVE-2025-23395
Alpine:v3.24	screen	5.0.1-r0	ALPINE-CVE-2025-23395

Affected products (as reported)

Vendor	Product	Versions
	screen	5.0 – through 5.0.0

Weakness: CWE-271 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References