CVE-2025-71263

Name: CVE-2025-71263
Creator: NVD / NIST
Published: 2026-03-13T19:53:53.983+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.18%

Last modified Jun 17, 2026

CVE-2025-71263 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.18%

7.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-120

Affected Software

Vendor	Product	Versions
Opengroup	Unix	4

References

https://discuss.systems/@ricci/115747843169814700Issue Tracking
https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/Press/Media Coverage
https://www.spinellis.gr/blog/20251223/Technical Description
https://www.tuhs.org/pipermail/tuhs/2026-January/032991.htmlIssue Tracking, Mailing List
http://www.openwall.com/lists/oss-security/2026/03/20/6Issue Tracking, Mailing List
http://www.openwall.com/lists/oss-security/2026/03/21/4Issue Tracking, Mailing List

Timeline

Published: Mar 13, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-71263?

How severe is CVE-2025-71263?

CVE-2025-71263 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.

How do I fix CVE-2025-71263?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-71263?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST