CVE-2026-82457: Incorrect Conversion between Numeric Types in ncopa su-exec

The su-exec utility through version 0.3 fails to properly validate numeric user and group identifiers parsed using strtol before assigning them to uid_t and gid_t types. This improper validation allows truncation of out-of-range numeric values to zero, which corresponds to the root user ID. Consequently, an attacker can supply large numeric identifiers that truncate to zero, causing su-exec to execute target programs with root privileges rather than the intended unprivileged user or group.

Successful exploitation allows an attacker with limited privileges to escalate to root privileges by causing su-exec to run processes as root instead of the intended unprivileged user. This results in a high-severity privilege escalation vulnerability.

No patch links or vendor advisories are provided, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of su-exec or restrict access to su-exec to trusted users only.