CVE-2016-2090: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 24 only; version 25 only
• Freedesktop Libbsd: before 0.8.2 (fixed in 0.8.2)

Published 2017-01-13. Last modified 2026-06-17.