CVE-2026-91142CWE-190

CVE-2026-91142

Low · published September 18, 2026

CVSS v3.1
3.6
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00119 · 1.7th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-09-18T21:17Z
References (2)
https://access.redhat.com/security/cve/CVE-2026-91142 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2479459 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 18 SEP 16:44Z
    Cockpit: integer overflow in `do_lastlog()` offset calculation can misaddress `lastlog` entries on ilp32 builds
    cvelistv5