CVE-2000-0786: GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERV...

Security readout for executives and security teams

GNU userv is a Unix helper that lets one local account safely run limited commands as another. In version 1.0.0 and earlier, a flaw in how it juggles file descriptors could corrupt the variables that record which groups a user belongs to. A local, logged-in user could exploit this to sidestep some access checks. It requires local access and only affects systems that installed the vulnerable userv package. Very narrow in 2026. userv is a niche Debian-era privilege boundary tool; exposure is limited to legacy Unix or Debian systems still running userv 1.0.0 or earlier with locally authenticated users. Not internet-reachable, not in CISA KEV, and no evidence of modern relevance in the cited sources. Low priority for most modern environments. Only relevant if the business still operates legacy Debian or Unix hosts running GNU userv as a privilege delegation tool. Address opportunistically during standard patch cycles; there is no evidence of active exploitation and remote attack is not possible. Mitigation focus: Upgrade GNU userv to 1.0.1 or later as identified in the Debian 2000-07-27 advisory.; Apply the current Debian security update for the userv package on any affected hosts.; Remove or disable userv on systems that no longer need the privilege boundary tool..

Prepared

Jul 12, 2026, 00:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.