Zetlyn
GitHubGet started

GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by i…

cve CVE-2000-0803 1 source, 1 claim · Watch

NVD writes:
GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff. the claim
Vendor
n/a NVD
Product
n/a NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2000-12-19first spoke of it: GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.NVD

GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.

What it is to other things

affectsgnu/groff
NVD
made_bygnu
NVD

In words only, so not counted until a person confirms one:

made_byn_a
NVD says “n/a”
affectsn_a/n_a
NVD says “n/a · n/a”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Product
product
NVDn/a
receipt
Source
NVD
Its words
n/a
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCn/a
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "n/a",
            "vendor": "n/a",
            "versions": [
              {
                "status": "affected",
                "version": "n/a"
              }
            ]
          }
        ],
        "source": "cve@mitre.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:gnu:groff:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "3D12195B-922F-44A8-BC6E-5FA696CB83AB",
                "versionEndExcluding": "1.17",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff."
      },
      {
        "lang": "es",
        "value": "GNU Groff usa el directorio de trabajo actual para encontrar un archivo de descripción de dispositivo, lo que permite a un usuario local obtener privilegios adicionales al incluir una directiva postpro maliciosa en el archivo de descripción, que se ejecuta cuando otro usuario ejecuta groff."
      }
    ],
    "id": "CVE-2000-0803",
    "lastModified": "2026-09-23T10:10:00.673",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "userInteractionRequired": false
        }
      ]
    },
    "published": "2000-12-19T05:00:00.000",
    "references": [
      {
        "source": "cve@mitre.org",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      }
    ],
    "sourceIdentifier": "cve@mitre.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-Other"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Status
status
NVDModified
receipt
Source
NVD
Its words
Modified
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "n/a",
            "vendor": "n/a",
            "versions": [
              {
                "status": "affected",
                "version": "n/a"
              }
            ]
          }
        ],
        "source": "cve@mitre.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:gnu:groff:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "3D12195B-922F-44A8-BC6E-5FA696CB83AB",
                "versionEndExcluding": "1.17",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff."
      },
      {
        "lang": "es",
        "value": "GNU Groff usa el directorio de trabajo actual para encontrar un archivo de descripción de dispositivo, lo que permite a un usuario local obtener privilegios adicionales al incluir una directiva postpro maliciosa en el archivo de descripción, que se ejecuta cuando otro usuario ejecuta groff."
      }
    ],
    "id": "CVE-2000-0803",
    "lastModified": "2026-09-23T10:10:00.673",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "userInteractionRequired": false
        }
      ]
    },
    "published": "2000-12-19T05:00:00.000",
    "references": [
      {
        "source": "cve@mitre.org",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      }
    ],
    "sourceIdentifier": "cve@mitre.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-Other"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Vendor
vendor
NVDn/a
receipt
Source
NVD
Its words
n/a
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCn/a
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "n/a",
            "vendor": "n/a",
            "versions": [
              {
                "status": "affected",
                "version": "n/a"
              }
            ]
          }
        ],
        "source": "cve@mitre.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:gnu:groff:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "3D12195B-922F-44A8-BC6E-5FA696CB83AB",
                "versionEndExcluding": "1.17",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff."
      },
      {
        "lang": "es",
        "value": "GNU Groff usa el directorio de trabajo actual para encontrar un archivo de descripción de dispositivo, lo que permite a un usuario local obtener privilegios adicionales al incluir una directiva postpro maliciosa en el archivo de descripción, que se ejecuta cuando otro usuario ejecuta groff."
      }
    ],
    "id": "CVE-2000-0803",
    "lastModified": "2026-09-23T10:10:00.673",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "nvd@nist.gov",
          "type": "Primary",
          "userInteractionRequired": false
        }
      ]
    },
    "published": "2000-12-19T05:00:00.000",
    "references": [
      {
        "source": "cve@mitre.org",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5280"
      }
    ],
    "sourceIdentifier": "cve@mitre.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-Other"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.
zetlyn/cve-nvd · 2000-12-19
product n/a status Modified vendor n/a source