CVE-2019-19520: xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVE...

Security readout for executives and security teams

CVE-2019-19520 is a local privilege escalation issue in OpenBSD 6.6 xlock. A user already able to run code locally could influence library loading through an environment variable and gain the privileges of the auth group. This is most urgent on shared or multi-user OpenBSD systems. Exposure appears limited to OpenBSD 6.6 systems where xlock/Xenocara/Mesa are present and untrusted or lower-privileged local users can execute code. No evidence in the bundle identifies other products or versions. Prioritize remediation on shared OpenBSD 6.6 servers, workstations, or bastion-like systems. The issue is local-only, but the auth group impact makes it significant where multiple users or compromised low-privilege accounts exist. Mitigation focus: Review OpenBSD 6.6 errata for the vendor-provided fix.; Apply the relevant OpenBSD security update or supported upgrade path.; Limit untrusted local shell access until remediation is complete..

Prepared

Jun 6, 2026, 03:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.