# CVE-1999-1186: rxvt privilege escalation via -print-pipe argument

Source: https://junglewise.ai/threats/cve-1999-1186-rxvt-privilege-escalation-via-print-pipe-argument  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-01-02. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1186 · Severity: high · CVSS 7.2 · Published 1996-01-02

rxvt is a terminal emulator used in older Linux distributions to provide a command-line interface within a graphical environment. A vulnerability exists where the program fails to drop administrative (root) privileges before executing a user-defined printing command. A local user with access to the system can exploit this to run any command with full administrative rights, leading to a complete takeover of the machine.

Technologies: [Redhat Linux](https://junglewise.ai/threats/technologies/linux), [Slackware Linux](https://junglewise.ai/threats/technologies/slackware-linux). Vendors: [Redhat](https://junglewise.ai/threats/vendors/redhat), [Slackware](https://junglewise.ai/threats/vendors/slackware).

## Quick answers

**Is CVE-1999-1186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1186 being exploited in the wild.

**How severe is CVE-1999-1186?** High severity, with a CVSS score of 7.2, published 2 January 1996.

**Which products and versions are affected?** rxvt project rxvt Slackware 3.0, RedHat 2.1, and other systems where rxvt is suid root.

**Is there a fix for CVE-1999-1186?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1186 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1186?** Check whether you run Redhat Linux, Rxvt or Slackware Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rxvt terminal emulator, when compiled with the PRINT_PIPE option and installed with the setuid root bit (often required for utmp logging), fails to drop privileges before invoking a pipe to a printer command. An attacker can use the '-print-pipe' command-line argument to specify an arbitrary executable instead of the intended printer utility. By sending the VT100 'printer-on' escape sequence (ESC[5i) to the terminal, the attacker triggers a popen() call that executes the malicious program with root privileges. This vulnerability affects early Linux distributions like Slackware 3.0 and RedHat 2.1. A temporary mitigation is to remove the setuid bit from the rxvt binary.

## Affected products

- rxvt project rxvt Slackware 3.0, RedHat 2.1, and other systems where rxvt is suid root

## Timeline

- 1996-01-02: disclosed: Initial bugtraq disclosure by David J Meltzer
- 1996-01-02: advisory: NVD published date

## References

- [http://marc.info/?l=bugtraq&m=87602167418966&w=2](http://marc.info/?l=bugtraq&m=87602167418966&w=2)

## Related threats

- [xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable.](https://junglewise.ai/threats/cve-1999-1490-xosview-1-5-1-in-red-hat-5-1-allows-local-users-to-gain-root)
- [Slackware Linux pkgtool symlink attack in reply file](https://junglewise.ai/threats/cve-1999-1498-slackware-linux-pkgtool-symlink-attack-in-reply-file)
- [Red Hat Linux 5 symlink attack in ifdhcpc-done script](https://junglewise.ai/threats/cve-1999-1407-red-hat-linux-5-symlink-attack-in-ifdhcpc-done-script)
- [Slackware imapd and ipop3d denial of service and info leak via core dump](https://junglewise.ai/threats/cve-1999-1445-slackware-imapd-and-ipop3d-denial-of-service-and-info-leak-via)
- [Slackware Linux buffer overflow in crond](https://junglewise.ai/threats/cve-1999-0340-slackware-linux-buffer-overflow-in-crond)