CVE-2025-71263

In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.systems/@ricci/115747843169814700	Issue Tracking
https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/	Press/Media Coverage
https://www.spinellis.gr/blog/20251223/	Technical Description
https://www.tuhs.org/pipermail/tuhs/2026-January/032991.html	Issue Tracking Mailing List
http://www.openwall.com/lists/oss-security/2026/03/20/6	Issue Tracking Mailing List
http://www.openwall.com/lists/oss-security/2026/03/21/4	Issue Tracking Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:o:opengroup:unix:4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-13 19:53

Updated : 2026-06-17 10:03

NVD link : CVE-2025-71263

Mitre link : CVE-2025-71263

CVE.ORG link : CVE-2025-71263

JSON object : View

Products Affected

opengroup

unix

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2025-71263", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71263", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T19:36:07.731823Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "AT&T Bell Labs", "product": "UNIX", "versions": [{"status": "affected", "version": "4", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-03-13T19:53:53.983", "references": [{"url": "https://discuss.systems/@ricci/115747843169814700", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/", "tags": ["Press/Media Coverage"], "source": "cve@mitre.org"}, {"url": "https://www.spinellis.gr/blog/20251223/", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "https://www.tuhs.org/pipermail/tuhs/2026-January/032991.html", "tags": ["Issue Tracking", "Mailing List"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/20/6", "tags": ["Issue Tracking", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/21/4", "tags": ["Issue Tracking", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "En UNIX Cuarta Edici\u00f3n de Investigaci\u00f3n (v4), el comando su es vulnerable a un desbordamiento de b\u00fafer debido a que la variable 'password' tiene un tama\u00f1o fijo de 100 bytes. Un usuario local puede explotar esto para obtener privilegios de root. Es poco probable que UNIX v4 se est\u00e9 ejecutando en alg\u00fan lugar fuera de un n\u00famero muy reducido de entornos de laboratorio."}], "lastModified": "2026-06-17T10:03:58.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opengroup:unix:4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AD46ACF-618C-4801-AA04-C3CBCDF854D0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}