Back to Security Advisories

Rxvt-Unicode Vulnerability — Ubuntu Security Update (USN-8991-1)

USN-8991-1 fixes CVE-2021-33477 in rxvt-unicode on Ubuntu: improperly handled escape sequences in displayed text can execute arbitrary code (CVSS 8.8, CVE-2021-33477 class). Update: sudo apt update && sudo apt upgrade rxvt-unicode and restart any running terminal sessions.

High 8.8 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Escape-sequence code execution in a terminal means displaying crafted output — a log file, a file listing, a curl response — runs code in the user's session without them clicking anything.

  1. Ubuntu Security Notices

  2. USN-8991-1

Publication date

3 November 2026

Overview

rxvt-unicode could be made to run programs as your login if it received
specially crafted input.

Releases


20.04 LTS


18.04 LTS


16.04 LTS

Packages

  • rxvt-unicode – RXVT-like terminal emulator with Unicode support

Details

It was discovered that rxvt-unicode incorrectly handled certain escape
sequences. An attacker could possibly use this issue to execute arbitrary
code if a user displayed specially crafted text in the terminal.

It was discovered that rxvt-unicode incorrectly handled certain escape
sequences. An attacker could possibly use this issue to execute arbitrary
code if a user displayed specially crafted text in the terminal.

Update instructions

After a standard system update you need to restart rxvt-unicode to make all
the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
20.04

LTS focal

 rxvt-unicode – 

9.22-6ubuntu0.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

18.04

LTS bionic

 rxvt-unicode – 

9.22-3ubuntu0.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

16.04

LTS xenial

 rxvt-unicode – 

9.21-1ubuntu0.1~esm1
rxvt-unicode-256color – 

9.21-1ubuntu0.1~esm1
rxvt-unicode-lite – 

9.21-1ubuntu0.1~esm1

References

Frequently Asked Questions

What is CVE-2021-33477?
It is an arbitrary code execution flaw in rxvt-unicode triggered by displaying text containing crafted escape sequences — CVSS 8.8, fixed in USN-8991-1 for Ubuntu's packaged version.
Who is affected?
Users running rxvt-unicode terminals who view output containing attacker-controlled text — log files, curl responses, file listings and chat messages all qualify as delivery channels.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade rxvt-unicode and close/reopen any open terminal sessions so they run the patched binary.
Why is displaying text dangerous in a terminal?
Terminals interpret escape sequences for cursor movement, colors and window title changes — flawed parsers let crafted sequences reach code paths that corrupt memory or execute commands, so the display channel becomes an execution channel.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System