Vulnerability in GNU Groff

CVE-2001-1022

Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command.

Published 2001-07-26 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.114 (95.9th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.114 · newest: 0.114 · change: 0.000

Affected products

GNU Groff — versions 1.10, 1.11, 1.11a
Jgroff

References

distro.conectiva.com.br/atualizacoes/ (vendor-advisory)
www.debian.org/security/2002/dsa-107 (vendor-advisory)
exchange.xforce.ibmcloud.com/vulnerabilities/6918 (vdb-entry)
www.securityfocus.com/bid/3103 (Exploit, Patch, vdb-entry)
www.debian.org/security/2001/dsa-072 (vendor-advisory, Patch, Vendor Advisory)
www.osvdb.org/1914 (vdb-entry)
www.redhat.com/support/errata/RHSA-2002-004.html (vendor-advisory)
www.securityfocus.com/archive/1/199706 (mailing-list, Patch)