What is CVE-2005-3120?

CVE-2005-3120 is a critical-severity vulnerability in Invisible-Island Lynx, classified under Incorrect Calculation of Buffer Size. CVSS score: 9.8/10. Published 2005-10-17.

How severe is CVE-2005-3120?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2005-3120 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Invisible-Island Lynx

CVE-2005-3120

Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.

Published 2005-10-17 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.233 (97.7th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.233 · newest: 0.233 · change: 0.000

Affected products

Invisible-Island Lynx
Debian Linux — versions 3.0, 3.1

Weakness classification (CWE)

CWE-131 — Incorrect Calculation of Buffer Size

Public proof-of-concept exploits

References

securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
secunia.com/advisories/18376 (Broken Link, third-party-advisory)
secunia.com/advisories/17216 (Broken Link, third-party-advisory)
secunia.com/advisories/17480 (Broken Link, third-party-advisory)
lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html (vendor-advisory, Broken Link)
slackware.com/security/viewer.php (vendor-advisory, Broken Link)
www.openpkg.org/security/OpenPKG-SA-2005.026-lynx.html (vendor-advisory, Broken Link)
lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html (Broken Link, Vendor Advisory, mailing-list, Patch)
www.securityfocus.com/archive/1/435689/30/4740/threaded (mailing-list, VDB Entry, Third Party Advisory, Broken Link)
secunia.com/advisories/17444 (Broken Link, third-party-advisory)

Frequently asked questions

What is CVE-2005-3120?: CVE-2005-3120 is a critical-severity vulnerability in Invisible-Island Lynx, classified under Incorrect Calculation of Buffer Size. CVSS score: 9.8/10. Published 2005-10-17.
How severe is CVE-2005-3120?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2005-3120 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.