Red Hat Issues xterm Fix for Escape Sequence Code Execution Flaw on Enterprise Linux
Red Hat has published RHSA-2026:92418, a Moderate-rated security update for the xterm package, issued on 29 October 2026 for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. The errata addresses a single issue, CVE-2022-45063, described by the vendor as code execution via OSC 50 input sequences in xterm. xterm is the terminal emulator for the X Window System, providing DEC VT102 and Tektronix 4014 compatible terminals for programs that cannot drive the window system directly, and it is present across a wide range of RHEL builds. The advisory covers Red Hat Enterprise Linux Server AUS 9.4 on x86_64, Red Hat Enterprise Linux Server for Power LE Update Services for SAP Solutions 9.4 on ppc64le, Red Hat Enterprise Linux for x86_64 Update Services for SAP Solutions 9.4, Red Hat Enterprise Linux for ARM 64 and IBM z Systems under the four years of updates stream, and the Extended Life Cycle channels for x86_64, ARM 64, Power little endian and IBM z Systems. The fixed build in every case is xterm-366-9.el9_4.1, shipped alongside the matching xterm-resize, debuginfo and debugsource packages.
Red Hat's errata names the mechanism only at a high level: the flaw is reached through OSC 50 input sequences, the Operating System Command control sequence that xterm interprets for font-related operations. Beyond that label, the vendor has not published exploitation detail, proof-of-concept code or a step-by-step chain in this advisory, instead directing readers to the CVE page for impact and CVSS scoring. What is stated plainly is that the outcome is code execution, which places the issue in the most serious class of terminal emulator defects rather than a display-corruption or denial-of-service bug. The issue is tracked internally as Bugzilla 2142474 and carries a Moderate security impact rating under Red Hat's own classification scheme. Customers using the Red Hat Lightspeed patch analysis service can have affected systems identified directly from the advisory page.
The significance of this update lies less in novelty than in reach and lifespan. CVE-2022-45063 is an older identifier now being backported into the Update Services for SAP Solutions, Advanced Update Support and Extended Life Cycle streams, which are precisely the channels used by organisations that cannot rebuild or re-platform on a normal cadence. SAP estates, regulated workloads and long-lived production servers tend to stay on a pinned minor release such as 9.4 for years, so a terminal emulator defect in those images has a correspondingly long window of exposure. Because xterm executes whatever control sequences appear in the byte stream it renders, a code execution flaw in sequence handling runs with the privileges of the user whose session owns the terminal, and on administrative or jump hosts that user is frequently a privileged one. On current exploitation status, FIRST EPSS places CVE-2022-45063 at a 5.4 percent probability of exploitation in the next 30 days, and neither the advisory nor the verified evidence available to us reports confirmed exploitation in the wild or any inclusion in CISA's Known Exploited Vulnerabilities catalogue. This is therefore a scheduled-maintenance item for most estates, with the caveat that the affected channels are the ones where patch cycles are slowest and the exposure window is longest.
Attack Surface
Server OS, Endpoint OS
Tactics
Execution
Techniques
- T1059 – Command and Scripting Interpreter
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Update xterm to build 366-9.el9_4.1 or later on all Red Hat Enterprise Linux 9.4 hosts covered by RHSA-2026:92418, using dnf update xterm xterm-resize, and confirm with rpm -q xterm that the installed release string is 366-9.el9_4.1.
- Include the companion packages shipped in the same errata where they are installed – xterm-resize-366-9.el9_4.1 plus the xterm-debuginfo and xterm-debugsource builds – so that mixed package versions do not leave an unpatched binary on the system.
- Enumerate exposure across the specific channels named in the advisory: RHEL Server AUS 9.4 x86_64, RHEL Server for Power LE Update Services for SAP Solutions 9.4 ppc64le, RHEL for x86_64 Update Services for SAP Solutions 9.4, RHEL for ARM 64 and IBM z Systems four years of updates 9.4, and the Extended Life Cycle streams for x86_64, aarch64, ppc64le and s390x.
- Use the Red Hat Lightspeed patch analysis linked from the RHSA-2026:92418 errata page to identify affected systems automatically rather than relying on manual inventory of SAP and extended-life-cycle hosts.
- Where xterm is not required on servers, remove it with dnf remove xterm to eliminate the component entirely, particularly on SAP application hosts and bastion servers that have no interactive X Window System requirement.
- Set the XTerm.vt100.allowFontOps resource to false in /etc/X11/app-defaults/XTerm or the user's ~/.Xresources on hosts where the patched package cannot be deployed immediately, which disables the OSC font operation handling that CVE-2022-45063 is reached through.
- Apply the verified SHA-256 digests published in the errata when staging packages into an internal mirror or Satellite repository, for example 04de700c2121a775b3e7ca9cdbf0f0cac4e6cbe1b751a918de848d5e8fc5bd1e for xterm-366-9.el9_4.1.src.rpm, before promoting the build to production channels.
