CVE-2025-71263 Details

A buffer overflow vulnerability has been identified in the 'su' command of UNIX Fourth Research Edition (v4). This vulnerability arises because the 'password' variable is fixed at 100 bytes, allowing local users to overflow the buffer and potentially gain root privileges. Although this version of UNIX is rarely used outside of specific lab environments, the vulnerability itself is significant as it reflects a common issue that can lead to unauthorized privilege escalation.

The vulnerability can be fixed by patching the 'su' source code to include a bounds check on the password input, preventing the buffer overflow. After applying the patch, the modified 'su' can be recompiled and installed with the appropriate setuid permissions.