Local privilege escalation via trailing escape overflow

Buffer overflow in NetHack 3.4.3 and earlier allows local users to gain elevated privileges through a crafted .nethackrc file. The escapes() parser in src/options.c consumes the terminating null byte and continues past the input when an escape ends with \M, a backslash, a caret, or a backslash followed by one decimal digit, potentially overflowing the output buffer. Exploitation requires a shared installation with NetHack running setuid or setgid and permission for local users to supply their own configuration files.