CVE-2001-1022: Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allo...

Security readout for executives and security teams

CVE-2001-1022 is an old command-execution flaw in the groff pic utility. If a vulnerable system processes attacker-controlled pic input, the safety option intended to block command execution can be bypassed. Business risk is concentrated in legacy Unix/Linux document or print-processing environments. Exposure is most likely on legacy systems that still run vulnerable groff or jgroff packages and process untrusted troff/pic content. The Bugtraq reference specifically points to a pic/lpd remote exploit context for Red Hat 7.0, but the bundle lacks full CPE data. Prioritize if legacy Linux printing or document conversion remains in use, especially internet- or user-facing pipelines. For modern environments without groff/jgroff exposure, urgency is lower but still worth confirming during legacy asset review. Mitigation focus: Check OS vendor advisories for patched groff or jgroff packages.; Upgrade or remove vulnerable groff and jgroff versions where present.; Restrict untrusted document and print inputs that invoke pic..

Prepared

Jul 1, 2026, 06:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.