CVE-2026-82457

su-exec versions through 0.3 parse numeric user and group identifiers with strtol but do not validate that the values fit before assigning them to the uid_t/gid_t types, so oversized values are silently truncated to zero. Because identifier zero corresponds to root on Unix systems, an attacker who can get su-exec invoked with a large numeric UID or GID (for example through a container entrypoint that accepts a user argument) causes the target program to run as root instead of the intended unprivileged account. The practical result is a local privilege escalation with high confidentiality, integrity, and availability impact on the affected system, per the CVSS 4.0 score of 8.5. Any deployment embedding su-exec 0.3 or earlier, most commonly as a privilege-dropping entrypoint helper in Alpine-based Docker images, is affected. There is currently no known exploitation: no public proof-of-concept, no CISA KEV listing, and a low 0.1% EPSS probability of exploitation within 30 days.

What to do: Rebuild dependent container images with a patched su-exec as soon as a fixed release becomes available, since every version through 0.3 is affected. As an interim mitigation, do not pass numeric UID/GID values that exceed the platform's uid_t/gid_t range to su-exec, prefer named accounts or in-range identifiers, and verify that running processes actually drop to the intended user (for example by checking the runtime UID). Defenders should also check whether their base images or entrypoint scripts invoke su-exec and track their distribution channels for an updated package.