Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2026-82457: su-exec may run programs as root
CVE-2026-82457 · published 5 days ago
Summary
The su-exec tool (versions up to 0.3) does not properly check large numeric user or group IDs, which can be reduced to zero and interpreted as the root account. This means a malicious user could cause programs launched through su-exec to run with full system privileges instead of a limited account. Update to a newer version of su-exec or apply the provided patch to ensure IDs are correctly validated.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ncopa | su-exec | <= 0.3 |
Original advisory text
su-exec through 0.3 Privilege Escalation via Numeric User ID
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.
References
- https://github.com/ncopa/su-exec/blob/89c016e6e08749d583efdeda04b9f73e1218e253/s... technical-description
- https://gist.github.com/thesmartshadow/ed96e2a88643c34a247c9b7cf9e311be third-party-advisory
- https://github.com/ncopa/su-exec product
- https://www.vulncheck.com/advisories/su-exec-through-0.3-privilege-escalation-vi... third-party-advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82457... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-82457 Vendor Advisory
Severity
8.4
High
CVSS 3.1: 7.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-681Incorrect Conversion between Numeric Types
Timeline
Published29 Aug 2026
Updated2 Sep 2026
First seen29 Aug 2026
Monitor software like this
Free during beta