su-exec EUVD-2026-68104

Exploitation requires the attacker to have at least low-privilege local code execution on the target system (PR:L per the CVSS 4.0 vector). The attacker must be able to invoke the su-exec binary directly - either because it is installed SUID-root and accessible to the attacker's user account, or because su-exec is called by a script the attacker can influence with arbitrary arguments. The target system must be a 64-bit Linux platform where long is 64-bit and uid_t is 32-bit (standard on x86_64 Linux), which is the case for effectively all modern Alpine Linux Docker containers. No special application feature flag or non-default configuration is required beyond su-exec being present and executable. Limiting factors are: (1) initial local or container-level access must be obtained via a separate vector since AV:L precludes direct remote exploitation; (2) su-exec must be present in the environment, which is common in Alpine Linux Docker images but not universal; (3) the attacker must be able to control the UID/GID argument passed to su-exec, which is trivially satisfied when the attacker has shell access.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.5 and accurately characterizes a locally exploitable, low-complexity privilege escalation requiring only low initial privileges - no special configuration, no user interaction, and no race condition. No EPSS data was provided in the source intelligence; however, the existence of a public proof-of-concept gist and the trivial exploitation mechanics (passing a single oversized integer argument) drive the realistic exploitation probability significantly higher than the absence of CISA KEV listing would suggest. The KEV-absent/POC-present signal combination is consistent with targeted exploitation or early-stage weaponization rather than confirmed broad campaigns. The primary risk context is Docker and Alpine Linux container environments where su-exec is embedded in entrypoint scripts: a low-privilege container breakout or web shell grants direct access to the su-exec binary, enabling immediate root escalation. The local attack vector (AV:L) is the primary mitigating signal - remote-only adversaries cannot exploit this without a separate initial access chain. The 'Information Disclosure' tag in the source intelligence is secondary to the primary impact of privilege escalation and full system compromise.

An attacker who has obtained a low-privilege shell inside a Docker container - for example, via exploitation of a web application vulnerability exposing remote code execution - locates the su-exec binary in the container filesystem. The attacker invokes su-exec with a crafted numeric UID argument of 4294967296 (2^32), which strtol() parses without error on a 64-bit system but which silently truncates to UID 0 upon assignment to uid_t, causing the target program to launch with root privileges. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/thesmartshadow/ed96e2a88643c34a247c9b7cf9e311be.