Skip to content

CVE-2003-0886

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to...

10.0 HighPublic exploitFix available

CVE-2003-0886 is a high vulnerability (CVSS 10.0) in Hylafax, published November 12, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. Fixed in hylafax 1:4.1.8-1.

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Exploit likelihood

12.7%Up 5.1 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: CVE-2003-0886
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: CVE-2003-0886
Updated: 2026-11-02

EUVDEUVD-2003-0876 No score

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: EUVD-2003-0876
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5g7x-gh8v-38vf No score

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to...

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: GHSA-5g7x-gh8v-38vf
Updated: 2026-11-02

OSV No score

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: CVE-2003-0886
Updated: 2026-11-02

OSVDEBIAN-CVE-2003-0886 No score

Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.

Record: DEBIAN-CVE-2003-0886
Updated: 2026-11-02

Affected products

hylafax

Affected packages

Affected packages
Package	Affected	Fixed
`hylafax` Debian:12	before 1:4.1.8-1	1:4.1.8-1
`hylafax` Debian:13	before 1:4.1.8-1	1:4.1.8-1
`hylafax` Debian:14	before 1:4.1.8-1	1:4.1.8-1
`hylafax` Debian:3.0	before 4.1.1-1.3	4.1.1-1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Hylafax 4.1.x - HFaxD Format String	2003-11-10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References