CVE-2022-24130
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer...
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
CVE-2022-24130- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:N/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
CVE-2022-24130- Updated
- 2026-11-02
EUVDEUVD-2022-29041 No score
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
EUVD-2022-29041- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5v7p-cf4c-24jq
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer...
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
GHSA-5v7p-cf4c-24jq- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-24130
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
ALPINE-CVE-2022-24130- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-8456
CVE-2022-24130 affecting package xterm for versions less than 372-1
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
AZL-8456- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSV
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
CVE-2022-24130- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24130
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
DEBIAN-CVE-2022-24130- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVOESA-2022-1563
xterm security update
It is a terminal emulator for the X Window System.
Security Fix(es):
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.(CVE-2022-24130)
- Record
OESA-2022-1563- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-2072
xterm security update
The xterm program is a terminal emulator for the X Window System.It provides DEC VT102 and Tektronix 4014 compatible terminals.
Security Fix(es):
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.(CVE-2022-24130)
- Record
OESA-2022-2072- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:14075
Red Hat Security Advisory: xterm security update
- Record
RHSA-2025:14075- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2025:14075
Moderate: xterm security update
The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly.
Security Fix(es):
- xterm: Buffer overflow in set_sixel in graphics_sixel.c (CVE-2022-24130)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:14075- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24130
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
- Record
UBUNTU-CVE-2022-24130- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2025:14075 No score
Moderate: xterm security update
The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly.
Security Fix(es):
- xterm: Buffer overflow in set_sixel in graphics_sixel.c (CVE-2022-24130)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:14075- Updated
- 2026-11-02
OSVMGASA-2022-0051 No score
Updated xterm packages fix security vulnerability
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. (CVE-2022-24130)
- Record
MGASA-2022-0051- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12733-1 No score
mlterm-3.9.2-3.1 on GA media
These are all security issues fixed in the mlterm-3.9.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12733-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3952-1 No score
Security update for xterm
This update for xterm fixes the following issues:
- CVE-2022-24130: Fixed buffer overflow in set_sixel when Sixel support is enabled. (bsc#1195387)
- Record
SUSE-SU-2022:3952-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3953-1 No score
Security update for xterm
This update for xterm fixes the following issues:
- CVE-2022-24130: Fixed buffer overflow in set_sixel when Sixel support is enabled (bsc#1195387).
- Record
SUSE-SU-2022:3953-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xtermAlpine:v3.15 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.16 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.17 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.18 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.19 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.20 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.21 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.22 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.23 |
before 371-r0 | 371-r0 |
xtermAlpine:v3.24 |
before 371-r0 | 371-r0 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xtermAlmaLinux:9 |
before 366-12.el9_6 | 366-12.el9_6 |
xterm-resizeAlmaLinux:9 |
before 366-12.el9_6 | 366-12.el9_6 |
xtermAzure Linux:2 |
before 372-1 | 372-1 |
xtermDebian:12 |
before 370-2 | 370-2 |
xtermDebian:13 |
before 370-2 | 370-2 |
xtermDebian:14 |
before 370-2 | 370-2 |
xtermDebian:9 |
before 327-2+deb9u2, plus listed versions 327-2327-2+deb9u1 |
327-2+deb9u2 |
xtermMageia:8 |
before 363-1.2.mga8 | 363-1.2.mga8 |
xtermopenEuler:20.03-LTS-SP1 |
before 334-6.oe1 | 334-6.oe1 |
xtermopenEuler:20.03-LTS-SP2 |
before 334-6.oe1 | 334-6.oe1 |
xtermopenEuler:20.03-LTS-SP3 |
before 334-6.oe1 | 334-6.oe1 |
xtermopenEuler:22.03-LTS |
before 363-4.oe2203 | 363-4.oe2203 |
xtermRed Hat:enterprise_linux:9::appstream |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xterm-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xterm-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xterm-resizeRed Hat:enterprise_linux:9::appstream |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xterm-resize-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xtermRocky Linux:9 |
before 0:366-12.el9_6 | 0:366-12.el9_6 |
xtermSUSE:Linux Enterprise Server 12 SP5 |
before 308-5.6.1 | 308-5.6.1 |
xtermSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 308-5.6.1 | 308-5.6.1 |
xtermSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 330-150200.11.6.1 | 330-150200.11.6.1 |
xtermSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 330-150200.11.6.1 | 330-150200.11.6.1 |
xtermopenSUSE:Leap 15.3 |
before 330-150200.11.6.1 | 330-150200.11.6.1 |
xtermopenSUSE:Leap 15.4 |
before 330-150200.11.6.1 | 330-150200.11.6.1 |
xtermUbuntu:16.04:LTS |
All versions, plus listed versions 318-2ubuntu1318-2ubuntu2322-1ubuntu1322-1ubuntu1.2 |
None known |
xtermUbuntu:18.04:LTS |
All versions, plus listed versions 324-2ubuntu1330-1ubuntu1330-1ubuntu2330-1ubuntu2.2 |
None known |
xtermUbuntu:20.04:LTS |
All versions, plus listed versions 348-2ubuntu1353-1ubuntu1353-1ubuntu1.20.04.2 |
None known |
xtermUbuntu:22.04:LTS |
All versions, plus listed versions 366-1ubuntu1369-1ubuntu1370-1ubuntu1370-2ubuntu1371-1ubuntu1372-1ubuntu1 |
None known |
xtermUbuntu:24.04:LTS |
All versions, plus listed versions 384-1ubuntu1388-1ubuntu1389-1ubuntu1390-1ubuntu1390-1ubuntu2390-1ubuntu3 |
None known |
xtermUbuntu:25.10 |
All versions, plus listed versions 397-1ubuntu1398-1ubuntu1402-1ubuntu1 |
None known |
xtermUbuntu:26.10 |
All versions, plus listed versions 407-1ubuntu1409-1ubuntu1410-1ubuntu1411-1ubuntu1 |
None known |
xtermUbuntu:26.04:LTS |
All versions, plus listed versions 402-1ubuntu1403-1ubuntu1404-1ubuntu1405-1ubuntu1406-1ubuntu1407-1ubuntu1 |
None known |
mltermopenSUSE:Tumbleweed |
before 3.9.2-3.1 | 3.9.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24130 is a medium vulnerability (CVSS 5.5) in Invisible-island Xterm, published January 31, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. Fixed in xterm 371-r0.
References
twitter.com/nickblack/status/1487731459398025216
openwall.com/lists/oss-security/2022/01/30/2
invisible-island.net/xterm/xterm.log.html
lists.debian.org/debian-lts-announce/2022/02/msg00007.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP5Y4O7WBNLV24D22E6LE7RQFYOUVD2U
Show 27 moreShow less
security.gentoo.org/glsa/202208-22
nvd.nist.gov/vuln/detail/CVE-2022-24130
github.com/advisories/GHSA-5v7p-cf4c-24jq
security.alpinelinux.org/vuln/CVE-2022-24130
access.redhat.com/errata/RHSA-2025:14075
bugzilla.redhat.com/2048676
errata.almalinux.org/9/ALSA-2025-14075.html
security-tracker.debian.org/tracker/CVE-2022-24130
advisories.mageia.org/MGASA-2022-0051.html
bugs.mageia.org/show_bug.cgi?id=29975
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1563
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14075.json
cve.org/CVERecord?id=CVE-2022-24130
errata.rockylinux.org/RLSA-2025:14075
suse.com/support/update/announcement/2022/suse-su-20223952-1
bugzilla.suse.com/1195387
ubuntu.com/security/CVE-2022-24130