su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

CVE-2026-82457 affects su-exec through version 0.3, a utility used to execute programs with different user/group privileges. The vulnerability stems from a failure to validate numeric user and group identifiers parsed with strtol before assigning them to uid_t and gid_t types. This allows integer truncation of out-of-range values to zero, which corresponds to the root user identifier. An attacker can supply a large numeric user or group identifier that truncates to root's UID (0), causing su-exec to execute target programs with full root privileges instead of the intended unprivileged account. This represents a privilege escalation vulnerability that can be exploited by supplying crafted input values. The flaw is particularly concerning in containerized environments where su-exec is commonly used. No patch has been confirmed in the referenced version, and a proof-of-concept has been published on GitHub Gist.