CVE-2011-1496: tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privi...

Security readout for executives and security teams

CVE-2011-1496 is a local privilege issue in tmux 1.3 and 1.4. A user already able to run commands on a host may gain utmp group privileges through the -S socket filename option. This is not described as remote compromise or root access in the provided sources. Exposure is most likely on older Unix-like systems running tmux 1.3 or 1.4, especially where untrusted local users have shell access. Modern distributions are likely patched, but legacy servers, appliances, and frozen images should be checked. Treat this as a legacy local privilege-escalation cleanup item. It is not evidenced as remotely exploitable, but shared Unix systems and old server images should be remediated to reduce lateral movement and privilege abuse risk. Mitigation focus: Inventory hosts for tmux 1.3 and 1.4 installations.; Apply vendor security updates from Debian, Fedora, or the relevant package maintainer.; Replace unsupported tmux builds with a maintained distribution package..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.