TOCTOU Race Condition in Screen Package - CVE-2025-46805
Summary
CVE-2025-46805: Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root. Affects screen versions < 4.9.1_git20250512-r0. Fixed in 4.9.1_git20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Screen package is a terminal multiplexer that allows users to manage multiple terminal sessions from a single window. It is widely used in Unix-like operating systems for its ability to detach and reattach sessions, making it a valuable tool for remote work and server management. However, versions 5.0.0 and older 4.x releases are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition, which can lead to privilege escalation.
Vulnerability Detail
CVE-2025-46805 is a vulnerability in the Screen package that arises from a TOCTOU race condition. This flaw allows an attacker to send signals such as SIGHUP and SIGCONT to privileged processes when Screen is installed with setuid-root permissions. The vulnerability can be exploited to disrupt or control processes that should remain secure, potentially leading to unauthorized access or system instability.
How To Fix
Minimum fixed version
4.9.1_git20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade screenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider removing the setuid-root permissions from the Screen binary until the package can be updated. This can be done with the following command:
chmod u-s /usr/bin/screen
Conclusion
CVE-2025-46805 presents a significant security risk for users of the Screen package, particularly those with setuid-root installations. It is crucial to update to the patched versions as soon as possible to safeguard against potential exploitation.
See every vulnerability recorded for screen →
FAQ
CVE-2025-46805 is a vulnerability in the Screen package that allows for a TOCTOU race condition, potentially enabling unauthorized signal sending to privileged processes.
Screen versions 5.0.0 and older 4.x releases are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to privilege escalation, allowing attackers to disrupt or control critical processes.
As a temporary measure, you can remove setuid-root permissions from the Screen binary to mitigate the risk until an update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for screen.
