CVE-2022-45063: xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and t...

Security readout for executives and security teams

This affects xterm before version 375. A crafted terminal control sequence involving font operations could cause command execution in a specific shell editing context, such as Zsh vi mode. The risk is narrower than a general remote-code-execution bug because exposure depends on xterm configuration, terminal use, and shell behavior. Most likely exposure is Linux or Unix workstations, jump hosts, or administrative environments using xterm before 375 with font operations enabled. Systems relying on distribution defaults may be less exposed where font operations are disabled. Treat this as a targeted workstation and administrator-terminal risk, not a broad server emergency. Prioritize patching systems used for privileged shell access and environments that display untrusted terminal output. Mitigation focus: Upgrade xterm to version 375 or later where available.; Apply Fedora, Gentoo, or other distribution security updates for xterm.; Confirm whether font operations are disabled in local xterm configuration..

Prepared

Jun 2, 2026, 01:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.