CVE-2004-2264

CVE-2004-2264 describes a format string vulnerability in GNU less versions 382, 381, and 358, specifically within the open_altfile function. This flaw could allow a local attacker to trigger a denial of service or potentially execute arbitrary code by injecting format strings into the LESSOPEN environment variable. While the CVSS score is 6.4 (medium severity), indicating potential for partial impact on integrity and availability, it's noted that this is not a vulnerability unless privilege boundaries can be crossed, as less is not setuid or setgid. There is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.