CVE-2025-71263 identifies a classic buffer overflow vulnerability (CWE-120) in the 'su' command of AT&T Bell Labs UNIX Fourth Research Edition (v4). The vulnerability stems from the 'password' variable being allocated a fixed size of 100 bytes without proper bounds checking during input copying. A local attacker can exploit this buffer overflow to overwrite adjacent memory, potentially allowing arbitrary code execution with root privileges. The vulnerability requires local access and has a high attack complexity, meaning exploitation is non-trivial and likely requires detailed knowledge of the system and memory layout. The CVSS v3.1 score is 7.4, reflecting high impact on confidentiality, integrity, and availability, but limited attack vector (local) and high complexity. Given the age and rarity of UNIX v4, this vulnerability is mostly of historical or academic interest rather than a widespread operational threat. No patches or known exploits are currently available. The vulnerability highlights the importance of secure coding practices even in legacy systems and the risks posed by buffer overflows in privileged commands.

If exploited, this vulnerability allows a local attacker to escalate privileges to root, compromising the entire system's confidentiality, integrity, and availability. Root access enables attackers to manipulate system files, install persistent backdoors, and disrupt system operations. However, the practical impact is limited by the rarity of UNIX v4 in production environments. Organizations running legacy UNIX v4 systems in research labs or historical computing environments face a risk of unauthorized root access if local user accounts are not tightly controlled. The vulnerability could be leveraged to gain full control over affected systems, potentially undermining trust in legacy research environments or causing data loss. Since no known exploits exist, the immediate threat is low, but the vulnerability remains a critical security concern for any remaining UNIX v4 installations.

Given the absence of official patches, organizations should implement strict local access controls to prevent untrusted users from executing the vulnerable 'su' command. Restrict physical and remote access to UNIX v4 systems to trusted personnel only. Employ system monitoring to detect unusual privilege escalation attempts. If feasible, replace or upgrade legacy UNIX v4 systems with modern, supported operating systems that have robust security controls and are actively maintained. For research or historical environments where upgrading is not possible, consider isolating these systems from networks and limiting user accounts to trusted administrators. Additionally, review and apply any available source code fixes or community patches if accessible. Conduct regular audits of user privileges and system logs to identify potential exploitation attempts.