Every CVE Search/ Get API key

CVE-2023-24809

NetHack Call command buffer overflow

5.5 MediumFix available

CVE-2023-24809 is a medium vulnerability (CVSS 5.5) in Nethack, published February 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in nethack 3.6.7-r0.

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.24%Down 0.7 points since Feb 18, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.5

NetHack Call command buffer overflow

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2023-28807 5.5

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
EUVD-2023-28807
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 5.5

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVALPINE-CVE-2023-24809 5.5

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
ALPINE-CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.5

NetHack Call command buffer overflow

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVDEBIAN-CVE-2023-24809 5.5

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
DEBIAN-CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-24809 5.5

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Record
UBUNTU-CVE-2023-24809
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nethack
Alpine:v3.18
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.19
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.20
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.21
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.22
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.23
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Alpine:v3.24
3.6.2 up to 3.6.7-r0
3.6.7-r0
nethack
Debian:12
All versions, plus listed versions
3.6.6-33.6.7-13.6.7-23.6.7-33.6.7-4
None known
nethack
Debian:13
before 3.6.7-1
3.6.7-1
nethack
Debian:14
before 3.6.7-1
3.6.7-1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
nethack
Ubuntu:16.04:LTS
All versions, plus listed versions
3.4.3-153.4.3-15build1
None known
nethack
Ubuntu:18.04:LTS
All versions, plus listed versions
3.6.0-4
None known
nethack
Ubuntu:20.04:LTS
All versions, plus listed versions
3.6.1-1
None known
nethack
Ubuntu:22.04:LTS
All versions, plus listed versions
3.6.6-2build1
None known
nethack
Ubuntu:24.04:LTS
All versions, plus listed versions
3.6.7-13.6.7-1build23.6.7-1build3
None known
nethack
Ubuntu:25.10
All versions, plus listed versions
3.6.7-1build33.6.7-2
None known
nethack
Ubuntu:26.10
All versions, plus listed versions
3.6.7-2build13.6.7-33.6.7-4
None known
nethack
Ubuntu:26.04:LTS
All versions, plus listed versions
3.6.7-23.6.7-2build1
None known

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-02createdCVE List, EUVD, NVD, OSV

References

MoveEnter Open