Every CVE Search/ Get API key

CVE-2025-46805

Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root

5.7 MediumFix available

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.18%Up 0.2 points since May 27, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.7

Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
CVE-2025-46805
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-367
Updated
2026-11-02
EUVDEUVD-2025-28070 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
EUVD-2025-28070
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v9hv-wgmv-7qj2 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to...

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
GHSA-v9hv-wgmv-7qj2
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-367
Updated
2026-11-02
NVD 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
CVE-2025-46805
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-367
Updated
2026-11-02
OSVALPINE-CVE-2025-46805 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
ALPINE-CVE-2025-46805
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2025-46805 5.5
Record
BELL-CVE-2025-46805
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2025-46805 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
DEBIAN-CVE-2025-46805
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1579 7.8

screen security update

Screen is a full-screen window manager that multiplexes a physical terminal between several processes,typically interactive shells.

Security Fix(es):

For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.(CVE-2025-46802)

A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.(CVE-2025-46804)

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.(CVE-2025-46805)

Record
OESA-2025-1579
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-46805 5.7

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
UBUNTU-CVE-2025-46805
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV No score

Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

Record
CVE-2025-46805
Updated
2026-11-02
OSVopenSUSE-SU-2026:12373-1 No score

screen-5.0.2-1.1 on GA media

These are all security issues fixed in the screen-5.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12373-1
Updated
2026-11-02
OSVUSN-7978-1 No score

screen vulnerabilities

It was discovered that GNU Screen incorrectly handled signals when setuid or setgid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-24626)

It was discovered that GNU Screen incorrectly handled PTY permissions. A local attacker could possibly use this issue to connect to an unauthorized screen session. (CVE-2025-46802)

It was discovered that GNU Screen incorrectly handled file access when setuid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to deduce information about certain file paths. (CVE-2025-46804)

It was discovered that GNU Screen incorrectly handled signals when setuid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. (CVE-2025-46805)

Record
USN-7978-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
screen
Alpine:v3.18
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.19
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.20
 before 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpine:v3.21
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.22
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.23
 before 5.0.1-r0
5.0.1-r0
screen
Alpine:v3.24
 before 5.0.1-r0
5.0.1-r0
screen
Alpaquita:23
 4.9.0-r0 up to 4.9.1_git20250512-r0
4.9.1_git20250512-r0
screen
Alpaquita:stream
 4.9.0-r1 up to 5.0.1-r0
5.0.1-r0
screen
Debian:12
 All versions, plus listed versions
4.9.0-44.9.1-14.9.1-1+hurd.14.9.1-1+hurd.24.9.1-2
Show 8 moreShow less
4.9.1-34.9.1-3.15.0.1-15.0.1-1.15.0.1-1.1+be5.0.1-25.0.1-35.0.2-1
 None known
Show 16 moreShow less
Affected packages
PackageAffectedFixed
screen
Debian:13
 before 4.9.1-3
4.9.1-3
screen
Debian:14
 before 4.9.1-3
4.9.1-3
screen
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2203sp4
4.9.0-3.oe2203sp4
screen
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2403sp1
4.9.0-3.oe2403sp1
screen
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2403sp1
4.9.0-3.oe2403sp1
screen
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 4.8.0-7.oe2003sp4
4.8.0-7.oe2003sp4
screen
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 4.9.0-3.oe2203sp3
4.9.0-3.oe2203sp3
screen
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.0.3-14ubuntu104.1.0~20120320gitdb59704-94.1.0~20120320gitdb59704-9ubuntu0.1~esm14.1.0~20120320gitdb59704-9ubuntu0.1~esm24.1.0~20120320gitdb59704-9ubuntu0.1~esm3
 None known
screen
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.3.1-24.3.1-2build14.3.1-2ubuntu0.14.3.1-2ubuntu0.1+esm1
 None known
screen
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.6.1-14.6.2-14.6.2-1ubuntu14.6.2-1ubuntu1.14.6.2-1ubuntu1.1+esm1
 None known
screen
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.6.2-3build14.7.0-14.8.0-14.8.0-1ubuntu0.1
 None known
screen
Ubuntu:22.04:LTS
 before 4.9.0-1ubuntu0.1, plus listed versions
4.8.0-64.8.0-6build14.8.0-74.9.0-1
4.9.0-1ubuntu0.1
screen
Ubuntu:24.04:LTS
 before 4.9.1-1ubuntu1, plus listed versions
4.9.0-44.9.1-14.9.1-1build1
4.9.1-1ubuntu1
screen
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 4.9.0-1ubuntu0.1, plus listed versions
4.8.0-64.8.0-6build14.8.0-74.9.0-1
4.9.0-1ubuntu0.1
screen
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 4.9.1-1ubuntu1, plus listed versions
4.9.0-44.9.1-14.9.1-1build1
4.9.1-1ubuntu1
screen
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 5.0.2-1.1
5.0.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46805 is a medium vulnerability (CVSS 5.7) in screen, published May 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in screen 4.9.1_git20250512-r0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open