CVE-2022-45063

Deeper analysis

CVE-2022-45063 affects xterm versions prior to 375 and stems from insufficient sanitization of font-related operations, notably OSC 50 escape sequences. An attacker-controlled response containing a Ctrl-G character can be interpreted as a command terminator, enabling arbitrary command execution when the terminal interacts with applications such as Zsh running in vi line-editing mode. The vulnerability carries a CVSS score of 9.8 and is classified under CWE-77; font operations are disabled by default in the xterm configurations shipped by several Linux distributions, limiting exposure in those environments.

An unauthenticated remote attacker can exploit the flaw over the network by supplying malicious terminal escape sequences that trigger the vulnerable font-operation path. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the user running the terminal session, resulting in complete compromise of confidentiality, integrity, and availability.

Public advisories published on the Openwall oss-security mailing list and entries in the xterm change log at invisible-island.net detail the issue and the corrective changes incorporated in version 375. Administrators are advised to update xterm to 375 or later and to verify that font operations remain disabled in any locally customized configurations.

EPSS scores for the CVE rose from lower values to a peak of 0.2570 on 2025-12-18 before receding to the current 0.1403, indicating a period of increased exploitation interest after disclosure.