CVE-2019-19726 is a local privilege escalation vulnerability affecting OpenBSD through version 6.6. It allows a local user to gain root privileges by manipulating the RLIMIT_DATA resource limit, causing the dynamic loader to fail in stripping LD_LIBRARY_PATH from setuid programs like chpass or passwd. This vulnerability carries a high CVSS score of 7.8, indicating a low attack complexity and the potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA KEV, public exploit code is available, including a Metasploit module, and it has garnered significant community discussion and media coverage, suggesting a heightened risk of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.6CPE matchmatch criteria | cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.