CVE-2026-91142 - Cockpit: integer overflow in `do_lastlog()` offset calculation can misaddress `lastlog` entries on ilp32 builds
Brief
CVE ID : CVE-2026-91142
Published : Sept. 18, 2026, 4:44 p. m.
- 12 minutes ago
Description : A flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on ILP32 (Integer, Long, Pointer 32-bit) builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID (UID) can cause the computed offset to wrap around.
This allows the user to perform unauthorized reads and writes to other users' `lastlog` records, potentially disclosing or altering sensitive login accounting information.
Severity: 3.6
- LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...