CVE-2022-46663 Other in n/a

High 7.5 Published 7 Feb 2023 Updated 25 Mar 2025

Attackers can execute arbitrary commands via terminal escape sequences when using the less pager with the -R flag.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-46663?

CVE-2022-46663 is a high-severity vulnerability in Fedoraproject Fedora, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.

Which versions are affected by CVE-2022-46663?

It affects 2 products.

Linux distribution packages (10)

`less` AlmaLinux:9	All versions	`590-2.el9_2`
`less` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-2.el9_2`
`less-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-2.el9_2`
`less-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-2.el9_2`
`less` Rocky Linux:9	All versions	`0:590-2.el9_2`
`less` SUSE:Linux Enterprise Micro 5.3	All versions	`590-150400.3.3.1`
`less` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`590-150400.3.3.1`
`less` openSUSE:Leap 15.4	All versions	`590-150400.3.3.1`
`less` openSUSE:Leap Micro 5.3	All versions	`590-150400.3.3.1`
`less` openSUSE:Tumbleweed	All versions	`608-2.1`

Products include Fedoraproject Fedora, Gnu Less.

How do I fix CVE-2022-46663?

Upgrade to a fixed version.

Is CVE-2022-46663 being exploited?

There is no known exploitation of CVE-2022-46663 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2023:3725, AZL-13350, BELL-CVE-2022-46663, DEBIAN-CVE-2022-46663, GHSA-5xw7-xf7p-gm82, OESA-2023-1129 and 6 more.