Junglewise Threat Intelligence

CVE-2025-71263: AT&T Bell Laboratories UNIX v4 buffer overflow in su

CVE-2025-71263 · Severity: high · CVSS 7.4 · Published 2026-03-13

Executive brief

The 'su' utility in the historic UNIX Fourth Research Edition (v4) contains a security flaw that allows a local user to gain full administrative (root) control of the system. By entering an excessively long password, a user can trigger a memory error that bypasses security checks. This vulnerability primarily affects vintage computing enthusiasts and researchers using PDP-11 simulators, as the software has been unsupported for decades.

Technical details

A classic stack-based buffer overflow exists in the 'su.c' utility of UNIX Fourth Research Edition (v4). The program defines a fixed-size 'password' buffer of 100 bytes but uses a 'while' loop with 'getchar()' to read user input without performing bounds checking. A local attacker can provide a password string exceeding 100 characters to overwrite adjacent memory. Depending on the memory layout and the specific payload, this can be leveraged to redirect execution flow and spawn a root shell. The vulnerability was identified following the 2025 recovery of the v4 source code and can be mitigated by implementing index-based bounds checking in the input loop.

Affected products

  • AT&T Bell Laboratories UNIX Fourth Research Edition (v4) v4

Timeline

  • 1973-11: disclosed: UNIX Fourth Research Edition released with the vulnerable code.
  • 2025-12-31: other: Vulnerability rediscovered and documented by security researchers after tape recovery.
  • 2026-03-13: advisory: CVE-2025-71263 assigned and published.

References