Description
xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Ben Williams · clocalunix
https://www.exploit-db.com/exploits/20154
References (6)
Scores
EPSS
0.0061
EPSS Percentile
69.9%
Details
Status
published
Products (2)
david_bagley/xlock
4.16
david_bagley/xlock
4.16.1
Published
Oct 20, 2000
Tracked Since
Feb 18, 2026