USN-8991-1: rxvt-unicode vulnerability

Publication date

3 November 2026

Overview

rxvt-unicode could be made to run programs as your login if it received specially crafted input.


Packages

  • rxvt-unicode - RXVT-like terminal emulator with Unicode support

Details

It was discovered that rxvt-unicode incorrectly handled certain escape
sequences. An attacker could possibly use this issue to execute arbitrary
code if a user displayed specially crafted text in the terminal.

It was discovered that rxvt-unicode incorrectly handled certain escape
sequences. An attacker could possibly use this issue to execute arbitrary
code if a user displayed specially crafted text in the terminal.

Update instructions

After a standard system update you need to restart rxvt-unicode to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
20.04 LTS focal rxvt-unicode –  9.22-6ubuntu0.1~esm1  
18.04 LTS bionic rxvt-unicode –  9.22-3ubuntu0.1~esm1  
16.04 LTS xenial rxvt-unicode –  9.21-1ubuntu0.1~esm1
rxvt-unicode-256color –  9.21-1ubuntu0.1~esm1
rxvt-unicode-lite –  9.21-1ubuntu0.1~esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›