CVE-2026-82457High· 7.8▾ Twilightsu-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that trun…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84966Medium· 5.1An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly
CVE-2026-6426Medium· 4.4A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling
CVE-2026-77412High· 8.9RabbitMQ amqp091-go is a Go AMQP 0.9.1 client
CVE-2026-89450High· 7.0kernel: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (CVE-2026-89450)
CVE-2026-84970Medium· 6.2A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library
CVE-2026-69438High· 8.1Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network.