CVE-2020-5254— NetHack hilite_status parsing privilege escalation
Quick assessment
Affected
NetHack NetHack
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NetHack是一款角色扮演类单人游戏。 NetHack 3.6.6之前版本中存在缓冲区错误漏洞。攻击者可利用该漏洞提升权限。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-5254
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NetHack hilite_status parsing privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
NetHack 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NetHack是一款角色扮演类单人游戏。 NetHack 3.6.6之前版本中存在缓冲区错误漏洞。攻击者可利用该漏洞提升权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2020-5254
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/dpmdpm2/CVE-2020-5254 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-5254
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-5254 (1)
-
https://github.com/NetHack/NetHack/security/advisories/GHSA-2ch6-6r8h-m2p9 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: NetHack
-
CVE-2023-24809
NetHack Call command buffer overflow -
CVE-2020-5253
Privilege escalation in NetHack -
CVE-2020-5211
NetHack AUTOCOMPLETE configuration file option is subject to -
CVE-2020-5212
NetHack MENUCOLOR configuration file option is subject to a -
CVE-2020-5213
NetHack SYMBOL configuration file option is subject to a buf
Same vendor: NetHack
-
CVE-2023-24809
NetHack Call command buffer overflow -
CVE-2020-5253
Privilege escalation in NetHack -
CVE-2020-5211
NetHack AUTOCOMPLETE configuration file option is subject to -
CVE-2020-5212
NetHack MENUCOLOR configuration file option is subject to a -
CVE-2020-5213
NetHack SYMBOL configuration file option is subject to a buf
Same weakness: CWE-125
-
CVE-2026-96395
macOS Affinity <3.3.1 堆越界读取漏洞 -
CVE-2026-7826
Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_Rea -
CVE-2026-107738
SumatraPDF: Untrusted binary record offset used without lowe -
CVE-2026-107731
SumatraPDF: LIT parser range-validation flaws cause invalid- -
CVE-2026-107729
SumatraPDF: Unsigned-to-signed hdrLen validation bypass in S
V. Comments for CVE-2020-5254
No comments yet