Every CVE Search/ Get API key

CVE-2021-27135

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault...

9.8 CriticalFix available

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

8.18%Up 1.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
CVE-2021-27135
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
CVE-2021-27135
Updated
2026-11-02
EUVDEUVD-2021-13902 No score

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
EUVD-2021-13902
Updated
2026-11-03
GitHub AdvisoriesGHSA-3w4p-5chr-2r8f 9.8

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault...

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

Record
GHSA-3w4p-5chr-2r8f
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2021-27135 9.8

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
ALPINE-CVE-2021-27135
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-7454 9.8

CVE-2021-27135 affecting package xterm for versions less than 372-1

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
AZL-7454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 20 moreShow less
OSV 9.8

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
CVE-2021-27135
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-27135 9.8

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
DEBIAN-CVE-2021-27135
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1091 9.8

xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals.

Security Fix(es):

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.(CVE-2021-27135)

Record
OESA-2021-1091
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0611 9.6

Red Hat Security Advisory: xterm security update

Record
RHSA-2021:0611
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0617 9.6

Red Hat Security Advisory: xterm security update

Record
RHSA-2021:0617
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0650 9.6

Red Hat Security Advisory: xterm security update

Record
RHSA-2021:0650
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0651 9.6

Red Hat Security Advisory: xterm security update

Record
RHSA-2021:0651
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:0611 9.6

Important: xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly.

Security Fix(es):

  • xterm: crash when processing combining characters (CVE-2021-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:0611
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-27135 9.8

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Record
UBUNTU-CVE-2021-27135
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:0611 No score

Important: xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly.

Security Fix(es):

  • xterm: crash when processing combining characters (CVE-2021-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:0611
Updated
2026-11-02
OSVCLSA-2022-1650575983 No score

Fix of CVE: CVE-2021-27135

  • CVE-2021-27135: fix crash when processing combining characters
Record
CLSA-2022-1650575983
Updated
2026-11-02
OSVMGASA-2021-0094 No score

Updated xterm package fixes security vulnerability

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence. (CVE-2021-27135).

Record
MGASA-2021-0094
Updated
2026-11-02
OSVopenSUSE-SU-2021:0900-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0900-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2011-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)
Record
openSUSE-SU-2021:2011-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11527-1 No score

xterm-368-2.2 on GA media

These are all security issues fixed in the xterm-368-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11527-1
Updated
2026-11-02
OSVSUSE-SU-2021:14747-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)
Record
SUSE-SU-2021:14747-1
Updated
2026-11-02
OSVSUSE-SU-2021:2011-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)
Record
SUSE-SU-2021:2011-1
Updated
2026-11-02
OSVSUSE-SU-2021:2013-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)
Record
SUSE-SU-2021:2013-1
Updated
2026-11-02
OSVSUSE-SU-2021:2014-1 No score

Security update for xterm

This update for xterm fixes the following issues:

  • CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091)
Record
SUSE-SU-2021:2014-1
Updated
2026-11-02
OSVUSN-4746-1 No score

xterm vulnerability

Tavis Ormandy discovered that xterm incorrectly handled certain character sequences. A remote attacker could use this issue to cause xterm to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4746-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xterm
Alpine:v3.13
 before 367-r0
367-r0
xterm
Alpine:v3.14
 before 366-r0
366-r0
xterm
Alpine:v3.15
 before 366-r0
366-r0
xterm
Alpine:v3.16
 before 366-r0
366-r0
xterm
Alpine:v3.17
 before 366-r0
366-r0
xterm
Alpine:v3.18
 before 366-r0
366-r0
xterm
Alpine:v3.19
 before 366-r0
366-r0
xterm
Alpine:v3.20
 before 366-r0
366-r0
xterm
Alpine:v3.21
 before 366-r0
366-r0
xterm
Alpine:v3.22
 before 366-r0
366-r0
Show 72 moreShow less
Affected packages
PackageAffectedFixed
xterm
Alpine:v3.23
 before 366-r0
366-r0
xterm
Alpine:v3.24
 before 366-r0
366-r0
xterm
AlmaLinux:8
 before 331-1.el8_3.2
331-1.el8_3.2
xterm-resize
AlmaLinux:8
 before 331-1.el8_3.2
331-1.el8_3.2
xterm
Azure Linux:2
 before 372-1
372-1
xterm
TuxCare:CentOS:6
 before 253-2.el6.cloudlinux.els
253-2.el6.cloudlinux.els
xterm
Debian:12
 before 366-1
366-1
xterm
Debian:13
 before 366-1
366-1
xterm
Debian:14
 before 366-1
366-1
xterm
Debian:9
 before 327-2+deb9u1, plus listed versions
327-2
327-2+deb9u1
xterm
Mageia:7
 before 344-1.1.mga7
344-1.1.mga7
xterm
Mageia:8
 before 363-1.1.mga8
363-1.1.mga8
xterm
openEuler:20.03-LTS
 before 334-5.oe1
334-5.oe1
xterm
openEuler:20.03-LTS-SP1
 before 334-5.oe1
334-5.oe1
xterm
Red Hat:enterprise_linux:8::appstream
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm-resize
Red Hat:enterprise_linux:8::appstream
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm-resize-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm
Red Hat:enterprise_linux:7::client
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm
Red Hat:enterprise_linux:7::server
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm
Red Hat:enterprise_linux:7::workstation
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:295-3.el7_9.1
0:295-3.el7_9.1
xterm
Red Hat:rhel_eus:8.1::appstream
 before 0:331-1.el8_1.1
0:331-1.el8_1.1
xterm-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:331-1.el8_1.1
0:331-1.el8_1.1
xterm-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 0:331-1.el8_1.1
0:331-1.el8_1.1
xterm-resize
Red Hat:rhel_eus:8.1::appstream
 before 0:331-1.el8_1.1
0:331-1.el8_1.1
xterm-resize-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:331-1.el8_1.1
0:331-1.el8_1.1
xterm
Red Hat:rhel_eus:8.2::appstream
 before 0:331-1.el8_2.1
0:331-1.el8_2.1
xterm-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:331-1.el8_2.1
0:331-1.el8_2.1
xterm-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:331-1.el8_2.1
0:331-1.el8_2.1
xterm-resize
Red Hat:rhel_eus:8.2::appstream
 before 0:331-1.el8_2.1
0:331-1.el8_2.1
xterm-resize-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:331-1.el8_2.1
0:331-1.el8_2.1
xterm
Rocky Linux:8
 before 0:331-1.el8_3.2
0:331-1.el8_3.2
xterm
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 238-3.3.1
238-3.3.1
xterm
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 238-3.3.1
238-3.3.1
xterm
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 330-11.3.1
330-11.3.1
xterm
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 330-11.3.1
330-11.3.1
xterm
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise Server 15-LTSS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise Server for SAP Applications 15
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Manager Proxy 4.0
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Manager Retail Branch Server 4.0
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Manager Server 4.0
 before 330-4.3.1
330-4.3.1
xterm
SUSE:Enterprise Storage 6
 before 330-4.3.1
330-4.3.1
xterm
SUSE:HPE Helion OpenStack 8
 before 308-5.3.1
308-5.3.1
xterm
SUSE:OpenStack Cloud 8
 before 308-5.3.1
308-5.3.1
xterm
SUSE:OpenStack Cloud 9
 before 308-5.3.1
308-5.3.1
xterm
SUSE:OpenStack Cloud Crowbar 8
 before 308-5.3.1
308-5.3.1
xterm
SUSE:OpenStack Cloud Crowbar 9
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server 12 SP5
 before 308-5.3.1
308-5.3.1
xterm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 308-5.3.1
308-5.3.1
xterm
Ubuntu:16.04:LTS
 before 322-1ubuntu1.2, plus listed versions
318-2ubuntu1318-2ubuntu2322-1ubuntu1
322-1ubuntu1.2
xterm
Ubuntu:18.04:LTS
 before 330-1ubuntu2.2, plus listed versions
324-2ubuntu1330-1ubuntu1330-1ubuntu2
330-1ubuntu2.2
xterm
Ubuntu:20.04:LTS
 before 353-1ubuntu1.20.04.2, plus listed versions
348-2ubuntu1353-1ubuntu1
353-1ubuntu1.20.04.2
xterm
openSUSE:Leap 15.2
 before 330-lp152.6.3.1
330-lp152.6.3.1
xterm
openSUSE:Leap 15.3
 before 330-11.3.1
330-11.3.1
xterm
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 368-2.2
368-2.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-27135 is a critical vulnerability (CVSS 9.8) in Invisible-island Xterm, published February 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.18%, the 94th percentile. Fixed in xterm 367-r0.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open