CVE-2026-82457

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Incorrect Conversion between Numeric Types. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

Rincian

Terbit di NVD

29 Agustus 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://gist.github.com/thesmartshadow/ed96e2a88643c34a247c9b7cf9e311be
• https://github.com/ncopa/su-exec
• https://github.com/ncopa/su-exec/blob/89c016e6e08749d583efdeda04b9f73e1218e253/su-exec.c
• https://www.vulncheck.com/advisories/su-exec-through-0.3-privilege-escalation-via-numeric-user-id