Every CVE Search/ Get API key

CVE-2021-26937

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service ...

9.8 CriticalFix available

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

9.26%Up 6.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-88
Updated
2026-11-02
CVE List No score

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
CVE-2021-26937
Updated
2026-11-02
EUVDEUVD-2021-13719 0.0

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
EUVD-2021-13719
CVSS
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pjrj-fmxp-cmc4 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service ...

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
GHSA-pjrj-fmxp-cmc4
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSVALPINE-CVE-2021-26937 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
ALPINE-CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-7356 9.8

CVE-2021-26937 affecting package screen for versions less than 4.9.1-1

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
AZL-7356
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVBELL-CVE-2021-26937 9.8

CVE-2021-26937 does not affect BellSoft software

Record
BELL-CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-26937 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
DEBIAN-CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1090 9.8

screen security update

Screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells.

Security Fix(es):

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.(CVE-2021-26937)

Record
OESA-2021-1090
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0742 9.6

Red Hat Security Advisory: screen security update

Record
RHSA-2021:0742
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1074 9.6

Red Hat Security Advisory: screen security update

Record
RHSA-2022:1074
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-26937 9.8

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
UBUNTU-CVE-2021-26937
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2021-1618497131 No score

Fix of CVE: CVE-2021-26937

  • fix CVE-2021-26937
Record
CLSA-2021-1618497131
Updated
2026-11-02
OSVCLSA-2021-1634925515 No score

Fixed CVE-2021-26937 in screen

  • fix CVE-2021-26937
Record
CLSA-2021-1634925515
Updated
2026-11-02
OSVMGASA-2021-0109 No score

Updated screen packages fix security vulnerability

Felix Weinmann reported a flaw in the handling of combining characters in screen, which can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence (CVE-2021-26937).

Record
MGASA-2021-0109
Updated
2026-11-02
OSVopenSUSE-SU-2021:0304-1 No score

Security update for screen

This update for screen fixes the following issues:

  • CVE-2021-26937: Fixed double width combining char handling that could lead to a denial of service or code execution (bsc#1182092).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0304-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11884-1 No score

screen-4.9.0-1.1 on GA media

These are all security issues fixed in the screen-4.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11884-1
Updated
2026-11-02
OSVSUSE-SU-2021:0491-1 No score

Security update for screen

This update for screen fixes the following issues:

  • CVE-2021-26937: Fixed double width combining char handling that could lead to a denial of service or code execution (bsc#1182092).
Record
SUSE-SU-2021:0491-1
Updated
2026-11-02
OSVSUSE-SU-2021:0492-1 No score

Security update for screen

This update for screen fixes the following issues:

  • CVE-2021-26937: Fixed double width combining char handling that could lead to a denial of service or code execution (bsc#1182092).
Record
SUSE-SU-2021:0492-1
Updated
2026-11-02
OSVUSN-4747-1 No score

screen vulnerability

Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4747-1
Updated
2026-11-02
OSVUSN-4747-2 No score

screen vulnerability

USN-4747-1 fixed a vulnerability in screen. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4747-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
screen
Alpine:v3.10
 before 4.6.2-r2
4.6.2-r2
screen
Alpine:v3.11
 before 4.7.0-r2
4.7.0-r2
screen
Alpine:v3.12
 before 4.8.0-r1
4.8.0-r1
screen
Alpine:v3.13
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.14
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.15
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.16
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.17
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.18
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.19
 before 4.8.0-r4
4.8.0-r4
Show 65 moreShow less
Affected packages
PackageAffectedFixed
screen
Alpine:v3.20
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.21
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.22
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.23
 before 4.8.0-r4
4.8.0-r4
screen
Alpine:v3.24
 before 4.8.0-r4
4.8.0-r4
screen
Azure Linux:2
 before 4.9.1-1
4.9.1-1
screen
TuxCare:CentOS:6
 before 4.0.3-20.el6.cloudlinux.els6
4.0.3-20.el6.cloudlinux.els6
screen
TuxCare:OracleLinux:6
 before 4.0.3-20.el6.cloudlinux.els6
4.0.3-20.el6.cloudlinux.els6
screen
Debian:12
 before 4.8.0-5
4.8.0-5
screen
Debian:13
 before 4.8.0-5
4.8.0-5
screen
Debian:14
 before 4.8.0-5
4.8.0-5
screen
Debian:9
 before 4.5.0-6+deb9u1, plus listed versions
4.5.0-6
4.5.0-6+deb9u1
screen
Debian:10
 before 4.6.2-3+deb10u1, plus listed versions
4.6.2-3
4.6.2-3+deb10u1
screen
Mageia:7
 before 4.6.2-2.2.mga7
4.6.2-2.2.mga7
screen
Mageia:8
 before 4.8.0-2.1.mga8
4.8.0-2.1.mga8
screen
openEuler:20.03-LTS
 before 4.8.0-2.oe1
4.8.0-2.oe1
screen
openEuler:20.03-LTS-SP1
 before 4.8.0-2.oe1
4.8.0-2.oe1
screen
Red Hat:enterprise_linux:7::client
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen
Red Hat:enterprise_linux:7::server
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen
Red Hat:enterprise_linux:7::workstation
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:4.1.0-0.27.20120314git3c2946.el7_9
0:4.1.0-0.27.20120314git3c2946.el7_9
screen
Red Hat:rhel_aus:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen-debuginfo
Red Hat:rhel_aus:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen
Red Hat:rhel_e4s:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen-debuginfo
Red Hat:rhel_e4s:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen
Red Hat:rhel_tus:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen-debuginfo
Red Hat:rhel_tus:7.7::server
 before 0:4.1.0-0.25.20120314git3c2946.el7_7.1
0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen
SUSE:HPE Helion OpenStack 8
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:OpenStack Cloud 7
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:OpenStack Cloud 8
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:OpenStack Cloud 9
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:OpenStack Cloud Crowbar 8
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:OpenStack Cloud Crowbar 9
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server 12 SP5
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 4.0.4-23.6.1
4.0.4-23.6.1
screen
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise Server 15-LTSS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise Server for SAP Applications 15
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Manager Proxy 4.0
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Manager Retail Branch Server 4.0
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Manager Server 4.0
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
SUSE:Enterprise Storage 6
 before 4.6.2-5.3.1
4.6.2-5.3.1
screen
Ubuntu:Pro:14.04:LTS
 before 4.1.0~20120320gitdb59704-9ubuntu0.1~esm2, plus listed versions
4.0.3-14ubuntu104.1.0~20120320gitdb59704-94.1.0~20120320gitdb59704-9ubuntu0.1~esm1
4.1.0~20120320gitdb59704-9ubuntu0.1~esm2
screen
Ubuntu:16.04:LTS
 before 4.3.1-2ubuntu0.1, plus listed versions
4.3.1-24.3.1-2build1
4.3.1-2ubuntu0.1
screen
Ubuntu:18.04:LTS
 before 4.6.2-1ubuntu1.1, plus listed versions
4.6.1-14.6.2-14.6.2-1ubuntu1
4.6.2-1ubuntu1.1
screen
Ubuntu:20.04:LTS
 before 4.8.0-1ubuntu0.1, plus listed versions
4.6.2-3build14.7.0-14.8.0-1
4.8.0-1ubuntu0.1
screen
openSUSE:Leap 15.2
 before 4.6.2-lp152.6.3.1
4.6.2-lp152.6.3.1
screen
openSUSE:Tumbleweed
 before 4.9.0-1.1
4.9.0-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26937 is a critical vulnerability (CVSS 9.8) in Gnu Screen, published February 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.26%, the 95th percentile. Fixed in screen 4.6.2-r2.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open