An unexpected behavior in systemd-journald allows ANSI escape sequences to be sent directly to the terminals of any logged‑in user when the "logger -p emerg" command is executed, provided the ForwardToWall option is enabled. This does not provide code execution but can modify terminal appearance or behavior through illicit escape codes, reflecting weaknesses in input sanitization (CWE-117) and misuse of terminal control (CWE-669).

The flaw affects machines running systemd version 259 when the journald configuration has ForwardToWall set to yes. Any system with that version and forwarding enabled is susceptible; the problem is tied to systemd itself rather than any specific application.

The CVSS score of 2.9 labels this vulnerability as low severity and an EPSS score below 1% suggests a very small likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to invoke ‘logger -p emerg’, which may be restricted to user or privileged contexts; this condition is inferred from the description. Consequently the risk surface is limited to local or locally privileged users on systems with ForwardToWall enabled, though the impact on user experience could be noticeable.