CVE-2021-26937: debian debian_linux Argument Injection

CVSS: 9.8v3.1CriticalModified

AliasesALPINE-CVE-2021-26937MGASA-2021-0109SUSE-SU-2021:0491-1+11 more

Published 09-02-2021Last modified 09-05-2025

Vulnerability summary

CVE-2021-26937 is a critical (CVSS 9.8) Argument Injection vulnerability in debian debian_linux. EPSS estimates a 9.15% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

9.15%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference

Timeline

09-02-2021
PublishedVulnerability first disclosed.
09-05-2025
Last modifiedVulnerability information updated.

Description

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

9.15%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 9.15% on 19-09-2026

19-09-202619-10-2026

EPSS score

9.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (lists.gnu.org)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Suse30 products

screen&distro=HPE Helion OpenStack 8< 4.0.4-23.6.1
screen&distro=SUSE Enterprise Storage 6< 4.6.2-5.3.1
screen&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 4.6.2-5.3.1
screen&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 4.6.2-5.3.1
screen&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 4.6.2-5.3.1

Show all 30

Debian2 products

screen< 4.8.0-5 | < 4.6.2-3+deb10u1 | < 4.5.0-6+deb9u1
debian_linuxEOL9.0 | 10.0

Mageia2 products

screen< 4.6.2-2.2.mga7
screen< 4.8.0-2.1.mga8

Opensuse2 products

screen&distro=openSUSE Leap 15.2< 4.6.2-lp152.6.3.1
screen&distro=openSUSE Tumbleweed< 4.9.0-1.1

Redhat2 products

screen< 0:4.1.0-0.27.20120314git3c2946.el7_9 | < 0:4.1.0-0.25.20120314git3c2946.el7_7.1
screen-debuginfo< 0:4.1.0-0.27.20120314git3c2946.el7_9 | < 0:4.1.0-0.25.20120314git3c2946.el7_7.1

Alpine1 product

screen< 4.6.2-r2 | < 4.7.0-r2 | < 4.8.0-r1 | < 4.8.0-r4

Fedoraproject1 product

fedoraEOL32 | 33

Gnu1 product

screen≤ 4.8.0

Ubuntu1 product

screen< 4.3.1-2ubuntu0.1 | < 4.6.2-1ubuntu1.1 | < 4.8.0-1ubuntu0.1 | < 4.1.0~20120320gitdb59704-9ubuntu0.1~esm2

9 vendors · 42 products

References

33 links

lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.htmlX Refsource MISCREPORTExploitMailing ListVendor Advisory
www.openwall.com/lists/oss-security/2021/02/09/3X Refsource MISCExploitMailing ListThird Party Advisory
ftp.gnu.org/gnu/screen/X Refsource MISCProduct
www.openwall.com/lists/oss-security/2021/02/09/8Mailing ListX Refsource MLISTExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2021/02/msg00031.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2021/dsa-4861Vendor AdvisoryX Refsource DEBIANWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
security.gentoo.org/glsa/202105-11Vendor AdvisoryX Refsource GENTOOThird Party Advisory
security.netapp.com/advisory/ntap-20250509-0004/

Show all 33 references

security.alpinelinux.org/vuln/CVE-2021-26937Advisory
advisories.mageia.org/MGASA-2021-0109.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=28390REPORT
www.suse.com/support/update/announcement/2021/suse-su-20210491-1/Advisory
bugzilla.suse.com/1182092REPORT
www.suse.com/security/cve/CVE-2021-26937WEB
www.suse.com/support/update/announcement/2021/suse-su-20210492-1/Advisory
access.redhat.com/errata/RHSA-2021:0742Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1927062REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0742.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-26937REPORT
www.cve.org/CVERecord?id=CVE-2021-26937AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-26937AdvisoryOval
access.redhat.com/errata/RHSA-2022:1074Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1074.jsonAdvisory
ubuntu.com/security/CVE-2021-26937REPORT
seclists.org/oss-sec/2021/q1/124REPORT
seclists.org/oss-sec/2021/q1/129REPORT
ubuntu.com/security/notices/USN-4747-1Advisory
ubuntu.com/security/notices/USN-4747-2Advisory
security-tracker.debian.org/tracker/CVE-2021-26937Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities