An authenticated local user with a large UID can exploit an integer overflow that occurs during session accounting in Cockpit on 32‑bit (ILP32) builds. The overflow is triggered when the calculated offset for writing to the legacy lastlog file wraps around, enabling the attacker’s login process to read or overwrite other accounts’ legacy log entries. This results in unauthorized disclosure or modification of login records but does not provide privilege escalation or remote execution.

The vulnerability affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Dev Spaces 3. Exact version numbers are not listed in the CNA data; the build type (ILP32) is the determining factor for whether the impact applies.

The CVSS score of 3.6 indicates a moderate level of risk. The EPSS score is 0.00125, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not widely exploited as of the latest data. Attackers need a locally authenticated account and the ability to assign large UIDs to invoke the overflow, so the vector is largely limited to local, enterprise environments that use 32‑bit builds of Cockpit. The primary threat is the unauthorized disclosure or modification of lastlog entries rather than escalated privileges or remote compromise.