CVE-2017-10685

CriticalCVSS 9.8

Published: 29/06/2017(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.26%

90th percentile - higher than 90% of all known CVEs

Summary

In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.

Risk Assessment

An attacker can remotely take control of the system, leading to full compromise of data confidentiality, integrity, and availability.

Recommendation

It is recommended to update ncurses to the latest available version that includes a fix for this vulnerability.

Original NVD description (English source)

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.