CVE-2003-0955

OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and...

4.6 MediumPublic exploit

OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow.

Exploit likelihood

1.14%Down 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 4.6

Record: CVE-2003-0955
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2003-0955
Updated: 2026-11-02

EUVDEUVD-2003-0945 No score

Record: EUVD-2003-0945
Updated: 2026-11-03

GitHub AdvisoriesGHSA-563f-qfcg-wp9f No score

OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and...

Record: GHSA-563f-qfcg-wp9f
Updated: 2026-11-02

Affected products

openbsd

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	OpenBSD - 'ibcs2_exec' Kernel Code Execution	2003-11-07
Exploit-DB	OpenBSD 2.x < 3.3 - 'exec_ibcs2_coff_prep_zmagic()' kernel stack overflow	2003-11-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2003-0955 is a medium vulnerability (CVSS 4.6) in Openbsd, published November 21, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. No source names a fixed version.