What is CVE-2003-0466?

CVE-2003-0466 is a critical-severity vulnerability in Apple Mac OS X, classified under Off-by-one Error. CVSS score: 9.8/10. Published 2003-08-27.

How severe is CVE-2003-0466?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Apple Mac OS X

CVE-2003-0466

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

Published 2003-08-27 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.781 (99.6th percentile), scored 2026-10-18.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.781 · newest: 0.781 · change: 0.000

Affected products

Apple Mac OS X — versions 10.2.6
Apple Mac OS X Server — versions 10.2.6
FreeBSD
NetBSD
OpenBSD
Sun Solaris — versions 9.0
Wuftpd Wu-Ftpd
Red Hat Wu Ftpd — versions 2.6.1-16

Weakness classification (CWE)

CWE-193 — Off-by-one Error

References

marc.info/ (mailing-list, Mailing List)
isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt (Broken Link)
secunia.com/advisories/9446 (Broken Link, third-party-advisory)
www.osvdb.org/6602 (vdb-entry, Broken Link)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:1970 (Broken Link, signature, vdb-entry)
www.securityfocus.com/archive/1/424852/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory, Broken Link)
www.securityfocus.com/bid/8315 (Exploit, Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, Vendor Advisory)
secunia.com/advisories/9423 (Broken Link, third-party-advisory)
marc.info/ (mailing-list, Mailing List)
archives.neohapsis.com/archives/vulnwatch/2003-q3/0065.html (Broken Link, Vendor Advisory, mailing-list, Exploit)

Frequently asked questions

What is CVE-2003-0466?: CVE-2003-0466 is a critical-severity vulnerability in Apple Mac OS X, classified under Off-by-one Error. CVSS score: 9.8/10. Published 2003-08-27.
How severe is CVE-2003-0466?: Critical severity. CVSS v3 base score is 9.8 out of 10.