The flaw in su‑exec version 0.3 allows a malicious user to craft numeric user or group identifiers that exceed the bounds of the uid_t and gid_t types. The conversion routine truncates the high‑order bits, turning a large value into zero, which maps to the root account. As a result, when an attacker supplies a large numeric UID or GID, su‑exec executes the requested program with root privileges instead of the intended unprivileged account. This represents a classic integer truncation vulnerability (CWE-681) that leads to elevation of privilege.

The affected product is the culprit executable maintained by ncopa, named su‑exec. No specific version list was supplied beyond the statement that versions up to 0.3 are vulnerable.

The calculated CVSS score of 8.5 indicates a high severity non‑remote local privilege escalation. The EPSS score is not available but the vulnerability is already known to experts, and it is not listed in the CISA KEV catalog. An attacker who can execute su‑exec, which runs as root, can supply a crafted large numeric identifier. The lack of input validation allows the value to truncate to zero, causing delivery of a root‑level process. This attack would need only local execution rights to the binary and is trivial to coerce once the binary exists on the system.