Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Simon McVittie questions whether libextractor CVE-2026-100310 is a realistic setuid privilege escalation.
Stories per day · 30 days
2 RSS
3 stories, newest first · one card per story
Stories tagged #setuid
The GNU C Library security advisories update for 2026-09-22
A glibc ld.so TOCTOU lets local attackers load code via $ORIGIN in setuid programs.
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.