CVE-2022-4170: Fedoraproject Extra Packages For Enterprise Linux

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: version 8.0 only
• Fedoraproject Fedora: version 37 only
• Rxvt-Unicode Project Rxvt-Unicode: version 9.25 only; version 9.26 only

Published 2022-12-09. Last modified 2026-06-17.