CVE-2022-45063: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days.

xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.

Affected products

• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Invisible-Island Xterm: before 375 (fixed in 375)

Published 2022-11-10. Last modified 2026-06-17.