Loading story…
Researchers analyzing a recently recovered Bell Labs Research Unix Version 4 source tree found a buffer overflow in /bin/su, the privilege-switching utility shipped with the 1973-era system. The flaw is in su.c, which stores password input in a 100-character buffer but reads characters without enforcing a length limit, allowing input to write past the end of the buffer. The issue was assigned CVE-2025-71263 and was highlighted on the oss-sec mailing list by Alan Coopersmith.
The vulnerability surfaced after users began running the recovered UNIX v4 software in PDP-11 simulators and reviewing its source code. Follow-up discussion on oss-sec noted that the affected platform is largely of historical interest, with some participants questioning the practical value of assigning a CVE to such an old system, but the reported bug remains a documented memory-safety flaw in a recovered legacy UNIX release.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The buffer overflow in /bin/su from recovered UNIX v4 was assigned CVE-2025-71263. Subsequent mailing list discussion questioned the practical relevance of assigning a CVE to a largely historical system.
Analysis of UNIX v4's su.c found that it uses a 100-character password buffer but reads password input without boundary checks, allowing writes past the end of the buffer in /bin/su.
A 1973 Bell Labs Research Unix Version 4 release was recently recovered from tape, and researchers began running the software in PDP-11 simulators and analyzing its source code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenBSD disclosed a local privilege-escalation vulnerability, tracked as **CVE-2026-57589**, in its System V semaphore implementation. The bug stems from an integer overflow in the `sys_semget()` handler that can lead to kernel memory corruption and allow a local user to escalate privileges to **root** under certain conditions. A fix was committed to **OpenBSD-current**, while patches for stable branches were still pending in the reporting cited. The flaw was reportedly identified during the **Patch the Planet** event focused on AI-assisted vulnerability research, and the same reporting also referenced separate OpenBSD findings affecting **IPsec/IPComp**, **NFS**, and the **pinsyscall** and **kbind** mechanisms.
Jul 16, 2026
A flaw in the Linux kernel FUSE subsystem, tracked as **`CVE-2026-31694`**, allows a local attacker to escalate privileges to root by exploiting how cached directory entries are handled during `readdir` operations. The bug is in `fuse_add_dirent_to_cache()`, where an attacker-controlled serialized FUSE directory entry can be copied into a single 4 KiB cache page without verifying that the entry itself fits, causing a **24-byte overflow** and adjacent memory corruption on affected systems. Reports say a malicious FUSE server can trigger the issue through oversized filename data returned to the kernel. Researchers demonstrated exploitation by corrupting cached bytes associated with a SUID binary such as **`/usr/bin/su`**, including a proof of concept that modified the cached `.init` page on Ubuntu 26.04 to execute code that calls `setuid(0)` and `setgid(0)` before spawning a root shell. The vulnerable logic was introduced in 2018, but practical exploitation reportedly became reachable with Linux `v6.16-rc1` after a 2025 increase to the `readdir` buffer size. An upstream patch has been accepted to reject directory entries whose serialized size exceeds `PAGE_SIZE` before caching, while interim mitigations include limiting FUSE use, removing the SUID bit from `fusermount3` where unnecessary, and restricting unprivileged user namespaces.
Aug 20, 2026
OpenSIPS disclosed **CVE-2026-45100**, a critical remotely exploitable buffer overflow in the `{s.b64encode}` string transformation affecting versions **3.4.0-beta through 3.6.5** and **4.0.0-beta**. The flaw stems from validating only the pre-encoding input against a 64 KB buffer, even though Base64 expansion can increase output size enough to overflow the buffer by up to **21,844 bytes**. An attacker can trigger the issue by sending a SIP message with a very large header value when an OpenSIPS routing script applies `{s.b64encode}` to attacker-controlled data. The overflow can corrupt adjacent transformation buffers and alter values used by later transformations processing the same SIP message, creating integrity and availability risk. OpenSIPS addressed the issue through code changes that enforce stricter bounds checks on input-derived lengths and related parsing logic across the codebase, including Base64 encoding and other buffer-sensitive components. The vendor fixed the vulnerability in **OpenSIPS 3.6.6** and **4.0.0-rc1**; the flaw is tracked as **CWE-120** and carries a **CVSS 9.1** rating.
Aug 5, 2026