Every CVE Search/ Get API key

CVE-2025-46804

Screen 5.0.0 and older versions allow file existence tests when installed setuid-root

2.0 LowFix available

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.22%Up 0.2 points since May 27, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.0

Screen 5.0.0 and older versions allow file existence tests when installed setuid-root

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
CVE-2025-46804
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
EUVDEUVD-2025-16307 2.0

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
EUVD-2025-16307
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pmh6-rrrw-xvhh 2.0

A minor information leak when running Screen with setuid-root privileges allosw unprivileged...

A minor information leak when running Screen with setuid-root privileges allosw unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
GHSA-pmh6-rrrw-xvhh
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
NVD 2.0

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
CVE-2025-46804
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSVALPINE-CVE-2025-46804 2.0

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
ALPINE-CVE-2025-46804
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2025-46804 3.3
Record
BELL-CVE-2025-46804
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2025-46804 2.0

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0.

Record
DEBIAN-CVE-2025-46804
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1579 7.8

screen security update

Screen is a full-screen window manager that multiplexes a physical terminal between several processes,typically interactive shells.

Security Fix(es):

For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.(CVE-2025-46802)

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.(CVE-2025-46804)

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.(CVE-2025-46805)

Record
OESA-2025-1579
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-46804 2.0

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0.

Record
UBUNTU-CVE-2025-46804
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV No score

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Record
CVE-2025-46804
Updated
2026-11-02
OSVopenSUSE-SU-2026:12373-1 No score

screen-5.0.2-1.1 on GA media

These are all security issues fixed in the screen-5.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12373-1
Updated
2026-11-02
OSVUSN-7978-1 No score

screen vulnerabilities

It was discovered that GNU Screen incorrectly handled signals when setuid or setgid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-24626)

It was discovered that GNU Screen incorrectly handled PTY permissions. A local attacker could possibly use this issue to connect to an unauthorized screen session. (CVE-2025-46802)

It was discovered that GNU Screen incorrectly handled file access when setuid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to deduce information about certain file paths. (CVE-2025-46804)

It was discovered that GNU Screen incorrectly handled signals when setuid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. (CVE-2025-46805)

Record
USN-7978-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
screen
Alpine:v3.18
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.19
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.20
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.21
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.22
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.23
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.24
 before 5.0.1-r0
5.0.1-r0
screen
Alpaquita:23
 4.9.0-r0 up to 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpaquita:stream
 4.9.0-r1 up to 5.0.1-r0
5.0.1-r0
screen
Debian:12
 All versions, plus listed versions
4.9.0-44.9.1-14.9.1-1+hurd.14.9.1-1+hurd.24.9.1-2
Show 8 moreShow less
4.9.1-34.9.1-3.15.0.1-15.0.1-1.15.0.1-1.1+be5.0.1-25.0.1-35.0.2-1
 None known
Show 16 moreShow less
Affected packages
PackageAffectedFixed
screen
Debian:13
 before 4.9.1-3
4.9.1-3
screen
Debian:14
 before 4.9.1-3
4.9.1-3
screen
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2203sp4
4.9.0-3.oe2203sp4
screen
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2403sp1
4.9.0-3.oe2403sp1
screen
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2403sp1
4.9.0-3.oe2403sp1
screen
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 4.8.0-7.oe2003sp4
4.8.0-7.oe2003sp4
screen
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2203sp3
4.9.0-3.oe2203sp3
screen
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.0.3-14ubuntu104.1.0~20120320gitdb59704-94.1.0~20120320gitdb59704-9ubuntu0.1~esm14.1.0~20120320gitdb59704-9ubuntu0.1~esm24.1.0~20120320gitdb59704-9ubuntu0.1~esm3
 None known
screen
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.3.1-24.3.1-2build14.3.1-2ubuntu0.14.3.1-2ubuntu0.1+esm1
 None known
screen
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.6.1-14.6.2-14.6.2-1ubuntu14.6.2-1ubuntu1.14.6.2-1ubuntu1.1+esm1
 None known
screen
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.6.2-3build14.7.0-14.8.0-14.8.0-1ubuntu0.1
 None known
screen
Ubuntu:22.04:LTS
 before 4.9.0-1ubuntu0.1, plus listed versions
4.8.0-64.8.0-6build14.8.0-74.9.0-1
4.9.0-1ubuntu0.1
screen
Ubuntu:24.04:LTS
 before 4.9.1-1ubuntu1, plus listed versions
4.9.0-44.9.1-14.9.1-1build1
4.9.1-1ubuntu1
screen
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 4.9.0-1ubuntu0.1, plus listed versions
4.8.0-64.8.0-6build14.8.0-74.9.0-1
4.9.0-1ubuntu0.1
screen
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 4.9.1-1ubuntu1, plus listed versions
4.9.0-44.9.1-14.9.1-1build1
4.9.1-1ubuntu1
screen
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 5.0.2-1.1
5.0.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46804 is a low vulnerability (CVSS 2.0) in screen, published May 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in screen 4.9.1_git20250512-r0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open