If an attacker provides an extremely large numeric identifier as input, the underlying system cast causes the value to truncate, wrapping around to zero, which corresponds to the root user identifier. Consequently, su-exec may fail to transition to the intended unprivileged user and instead execute the target command with full root privileges. This vulnerability impacts all versions of su-exec up to and including 0.3, posing a significant risk in environments where this utility is used as a security boundary for container entrypoints.

Impact

The successful exploitation of CVE-2026-82457 results in an attacker gaining unauthorized root-level access on the host or container, bypassing intended access controls. This vulnerability primarily affects Linux-based container environments that utilize su-exec to manage process user privileges. If exploited, an attacker can maintain persistent root access, modify system files, or move laterally within the containerized environment.

Recommendation

• Identify all instances of su-exec 0.3 or older within the environment, particularly within container images and orchestration configurations.
• Patch or upgrade the su-exec dependency to a version that addresses CVE-2026-82457 as soon as a fix is available from the maintainer.
• Audit container entrypoint scripts that invoke su-exec to ensure they do not accept untrusted user-supplied input for UID/GID arguments.
• Enforce the use of non-root users at the container orchestration level (e.g., Kubernetes SecurityContext) to minimize the impact of successful privilege escalation.