CVE-2017-10685
A critical flaw in ncurses 6.0 lets attackers run arbitrary code by sending specially crafted input. The bug is a format string error in the fmt_entry function. It could allow a remote attacker to take full control of the affected system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Systems running invisible-island ncurses 6.0 are affected.
Real-world impact
An attacker could execute arbitrary code on the system, potentially taking full control.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable remotely with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 29, 2017 · Jun 29, 2017PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.