CVE-2021-34557
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs....
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
CVE-2021-34557- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
CVE-2021-34557- Updated
- 2026-11-02
EUVDEUVD-2021-21207 No score
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
EUVD-2021-21207- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrwv-325w-f6ch No score
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs....
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
GHSA-hrwv-325w-f6ch- Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-34557
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
ALPINE-CVE-2021-34557- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
CVE-2021-34557- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-34557
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
DEBIAN-CVE-2021-34557- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-34557
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
- Record
UBUNTU-CVE-2021-34557- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0278 No score
Updated xscreensaver packages fix security vulnerability
An issue allowing to cause crash and locked screen bypass (CVE-2021-34557).
- Record
MGASA-2021-0278- Updated
- 2026-11-02
OSVSUSE-SU-2022:2641-1 No score
Security update for xscreensaver
This update for xscreensaver fixes the following issues:
- CVE-2021-34557: Fixed potential crash and unlock while disconnecting video output with more than 10 monitors (bsc#1186918)
- Record
SUSE-SU-2022:2641-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2642-1 No score
Security update for xscreensaver
This update for xscreensaver fixes the following issues:
- CVE-2021-34557: Fixed potential crash and unlock while disconnecting video output with more than 10 monitors (bsc#1186918)
- Record
SUSE-SU-2022:2642-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xscreensaverAlpine:v3.16 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.17 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.18 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.19 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.20 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.21 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.22 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.23 |
before 6.02-r0 | 6.02-r0 |
xscreensaverAlpine:v3.24 |
before 6.02-r0 | 6.02-r0 |
xscreensaverDebian:12 |
before 5.45+dfsg1-2 | 5.45+dfsg1-2 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xscreensaverDebian:13 |
before 5.45+dfsg1-2 | 5.45+dfsg1-2 |
xscreensaverDebian:14 |
before 5.45+dfsg1-2 | 5.45+dfsg1-2 |
xscreensaverMageia:8 |
before 5.45-1.4.mga8 | 5.45-1.4.mga8 |
xscreensaverMageia:8 |
before 5.45-1.4.mga8.tainted | 5.45-1.4.mga8.tainted |
xscreensaverSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 5.44-150000.5.6.1 | 5.44-150000.5.6.1 |
xscreensaveropenSUSE:Leap 15.3 |
before 5.44-150000.5.6.1 | 5.44-150000.5.6.1 |
xscreensaverSUSE:Linux Enterprise Server 12 SP5 |
before 5.22-8.3.1 | 5.22-8.3.1 |
xscreensaverSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 5.22-8.3.1 | 5.22-8.3.1 |
xscreensaverUbuntu:16.04:LTS |
All versions, plus listed versions 5.30-1ubuntu15.34-1ubuntu15.34-2ubuntu1 |
None known |
xscreensaverUbuntu:18.04:LTS |
All versions, plus listed versions 5.36-1ubuntu1 |
None known |
xscreensaverUbuntu:20.04:LTS |
All versions, plus listed versions 5.42+dfsg1-1ubuntu1 |
None known |
xscreensaverUbuntu:22.04:LTS |
All versions, plus listed versions 5.45+dfsg1-2ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34557 is a medium vulnerability (CVSS 4.6) in Xscreensaver Project Xscreensaver, published June 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in xscreensaver 6.02-r0.
References
github.com/QubesOS/qubes-issues/issues/6595
openwall.com/lists/oss-security/2021/06/05/1
Show 15 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV
nvd.nist.gov/vuln/detail/CVE-2021-34557
security.alpinelinux.org/vuln/CVE-2021-34557
security-tracker.debian.org/tracker/CVE-2021-34557
advisories.mageia.org/MGASA-2021-0278.html
bugs.mageia.org/show_bug.cgi?id=29086
suse.com/support/update/announcement/2022/suse-su-20222641-1
bugzilla.suse.com/1186918
ubuntu.com/security/CVE-2021-34557
cve.org/CVERecord?id=CVE-2021-34557