CVE-2003-0826

lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2)...

7.5 HighPublic exploitFix available

CVE-2003-0826 is a high vulnerability (CVSS 7.5) in Gnu Lsh, published September 23, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.1%, the 96th percentile. Fixed in lsh-utils 1.4.2-6.

lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.

Exploit likelihood

12.1%Down 3.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2003-0826
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2003-0826
Updated: 2026-11-02

EUVDEUVD-2003-0817 No score

Record: EUVD-2003-0817
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pgp8-cv9p-r5m2 No score

lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2)...

Record: GHSA-pgp8-cv9p-r5m2
Updated: 2026-11-02

OSV No score

Record: CVE-2003-0826
Updated: 2026-11-02

OSVDEBIAN-CVE-2003-0826 No score

Record: DEBIAN-CVE-2003-0826
Updated: 2026-11-02

Affected products

gnu lsh

Affected packages

Affected packages
Package	Affected	Fixed
`lsh-utils` Debian:12	before 1.4.2-6	1.4.2-6
`lsh-utils` Debian:3.0	before 1.2.5-2woody3, plus listed versions 1.2.5-21.2.5-2woody11.2.5-2woody2	1.2.5-2woody3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LSH 1.x - Remote Buffer Overflow (1)	2003-09-19
Exploit-DB	LSH 1.x - Remote Buffer Overflow (2)	2003-09-19

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV