CVE-2026-82457
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.12%
- CWE
- CWE-681
- Published
- 2026-08-29
- Last modified
- 2026-09-01
Affected products
- ncopa su-exec
Weakness type
Related vulnerabilities
- CVE-2026-69438 — Microsoft JScript Remote Code Execution Vulnerability
- CVE-2026-84963 — Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
- CVE-2026-84966 — BSON element injection via NUL-embedded document keys in builder append
- CVE-2026-84970 — Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
- CVE-2026-82522 — libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
- CVE-2026-75145 — FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
- CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
- CVE-2026-6426 — Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access