PatchTheCVECVE-2020-5212: In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffe
CVE-2020-5212 is a medium-severity flaw (CVSS 5.0) affecting nethack. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.1% (top 35%) |
| CISA exploited list | No |
| Weakness | CWE-120 |
| Published | 2020-01-28 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-5212?
nethack: upgrade to 3.6.5. Exact commands for each OS are on this page.
Is CVE-2020-5212 being exploited?
CVE-2020-5212 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-5212 affect?
CVE-2020-5212 affects nethack. Severity is medium (CVSS 5.0). In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHac
How urgent is CVE-2020-5212?
Priority 34/100. No elevated risk signals yet.
Related CVEs
- CVE-2023-24809 MEDIUM 5.5 UPGRADE NetHack is a single player dungeon exploration game
- CVE-2020-5254 LOW 3.9 UPGRADE In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited
- CVE-2020-5253 LOW 3.9 UPGRADE NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usuall
- CVE-2020-5214 MEDIUM 5.0 UPGRADE In NetHack before 3.6.5, detecting an unknown configuration file option can cause a buffer overflow resulting
- CVE-2020-5213 MEDIUM 5.0 UPGRADE In NetHack before 3.6.5, too long of a value for the SYMBOL configuration file option can cause a buffer overf