CVE-2003-0972: GNU Screen

High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days.

Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.

Affected products

• GNU Screen: version 3.9.4 only; version 3.9.8 only; version 3.9.9 only; version 3.9.10 only; version 3.9.11 only; version 3.9.13 only; …

Published 2003-12-15. Last modified 2026-06-16.