Increased PTY Access Risk in Screen Package - CVE-2025-46803
Summary
CVE-2025-46803: The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system. Affects screen versions < 5.0.1-r0. Fixed in 5.0.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Screen is a terminal multiplexer that allows users to manage multiple terminal sessions from a single interface. It is widely used in Unix-like operating systems for its ability to detach and reattach sessions, making it ideal for remote work. The package has a strong user base due to its functionality and ease of use. However, a recent vulnerability has been identified that alters the default permissions of pseudo terminals (PTYs), potentially exposing them to unauthorized access.
Vulnerability Detail
The vulnerability identified as CVE-2025-46803 arises from a change in the default mode of pseudo terminals allocated by the Screen package. The permissions were altered from 0620 to 0622, which allows any user on the system to write to any Screen PTYs. This change can lead to unauthorized users gaining access to sensitive terminal sessions, potentially compromising user data and system integrity. The issue stems from a misconfiguration in the permission settings, which can have serious implications for security in multi-user environments.
How To Fix
Minimum fixed version
5.0.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade screenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually change the permissions of the PTYs to restrict access. This can be done by executing the following command:
chmod 0620 /dev/pts/*
Conclusion
In summary, CVE-2025-46803 poses a significant risk to systems using the Screen package by allowing unauthorized access to pseudo terminals. It is crucial to update to the patched version to mitigate this risk. For immediate concerns, a temporary workaround is available to restrict access until the update can be applied.
See every vulnerability recorded for screen →
FAQ
CVE-2025-46803 is a vulnerability in the Screen package that allows unauthorized users to write to pseudo terminals due to altered permission settings.
This vulnerability can lead to unauthorized access to terminal sessions, potentially compromising sensitive information and system security.
Yes, the vulnerability can be fixed by updating the Screen package to version 5.0.1-r0 or later.
You can apply a temporary workaround by changing the permissions of the PTYs to restrict access using the command 'chmod 0620 /dev/pts/*'.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for screen.
