CVE-2003-0102: File

Medium severity, CVSS 4.6. EPSS: 2% chance of exploitation in the next 30 days.

Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).

Affected products

• File File: version 3.28 only; version 3.30 only; version 3.32 only; version 3.33 only; version 3.34 only; version 3.35 only; …
• Netbsd Netbsd: version 1.5 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 1.6 only

Published 2003-03-18. Last modified 2026-06-16.