CVE-2026-82457

Name of the Vulnerable Software and Affected Versions su-exec versions prior to 0.4

Description The software fails to validate numeric user and group identifiers parsed with the strtol() function before assigning them to uid t and gid t types. This allows out-of-range values to be truncated to zero. An attacker can provide large numeric identifiers that truncate to the root user identifier, leading to the execution of target programs with root privileges instead of the intended unprivileged accounts.

Recommendations Update su-exec to a version later than 0.3.