What’s Vulnerable › Vulnerabilities

CVE-2023-24809: NetHack Call command buffer overflow

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-17 · updated 2026-06-17
• Weakness: CWE-120

Description

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Affected products

• NetHack: from 3.6.2 before 3.6.7 — fixed in 3.6.7

How to fix

Upgrade to a fixed version: NetHack 3.6.7. Check the vendor advisory for mitigations.

References

• https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch
• https://nethack.org/security/CVE-2023-24809.html
• https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch
• https://nethack.org/security/CVE-2023-24809.html

Get alerted when CVE-2023-24809 or the next vulnerability affects your stack