CVE-2026-91142

Name of the Vulnerable Software and Affected Versions Cockpit (affected versions not specified)

Description An integer overflow occurs in the do lastlog() function during the offset calculation for lastlog entries on ILP32 (Integer, Long, Pointer 32-bit) builds. A low-privileged authenticated user with a specially provisioned large UID can cause the computed offset to wrap around, enabling unauthorized reads and writes to other users' lastlog records. This may lead to the disclosure or alteration of sensitive login accounting information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.