CVE-2000-0994: OpenBSD

High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days.

Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable.

Affected products

• OpenBSD OpenBSD: version 2.3 only; version 2.4 only; version 2.5 only; version 2.6 only; version 2.7 only

Published 2000-12-19. Last modified 2026-09-23.