Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen
Priority MEDIUM 59CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Partial SUSE Linux Enterprise Micro 5.3 (SUSE): 4.6.2-150000.5.8.1SUSE Linux Enterprise Micro 5.4 (SUSE): 4.6.2-150000.5.8.1+6 more productsRed Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Micro 5.3 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Micro 5.4 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Micro 5.5 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP6 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 15 SP6 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Desktop 15 SP6 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP6 | ? to before 4.6.2-150000.5.8.1 | 4.6.2-150000.5.8.1 | Patch available | CNA |
- SUSE Linux Enterprise Micro 5.3 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Micro 5.4 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Micro 5.5 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Module for Basesystem 15 SP6 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Server 15 SP6 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Desktop 15 SP6 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise Server for SAP Applications 15 SP6 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
- SUSE Linux Enterprise High Performance Computing 15 SP6 VendorSUSE Affected ? to before 4.6.2-150000.5.8.1 Fixed in 4.6.2-150000.5.8.1 Patch available CNA
Remediation
- Fix · CNA SUSE Linux Enterprise Micro 5.3 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Micro 5.4 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Micro 5.5 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Module for Basesystem 15 SP6 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Server 15 SP6 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Desktop 15 SP6 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise Server for SAP Applications 15 SP6 (SUSE) Fixed in 4.6.2-150000.5.8.1
- Fix · CNA SUSE Linux Enterprise High Performance Computing 15 SP6 (SUSE) Fixed in 4.6.2-150000.5.8.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46802
- 2026-10-03 Alias added: GHSA-rh76-vmrr-w867
References
More SUSE vulnerabilities
- TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-46802 · CVE Program
- CVE-2025-46802 · NVD
- FIRST EPSS
- GHSA-rh76-vmrr-w867 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-46802 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences