CVE-2000-0803: GNU Groff

High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days.

GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.

Affected products

• GNU Groff: before 1.17 (fixed in 1.17)

Published 2000-12-19. Last modified 2026-09-23.