CVE-2019-19726: OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid pr...

Security readout for executives and security teams

This vulnerability lets a local OpenBSD user potentially become root by abusing how the dynamic loader handled environment cleanup under low memory limits. It is not described as a remote entry point, but it can turn any local foothold on affected OpenBSD systems into full system control. Exposure is limited to OpenBSD systems through version 6.6 where untrusted users, compromised accounts, or applications can execute local programs. Systems without local user access are less directly exposed, but post-compromise privilege escalation remains relevant. Prioritize affected OpenBSD servers that host shared users, remote administration accounts, or exposed services. The business risk is full host takeover after a local foothold, not initial remote compromise by itself. Mitigation focus: Apply OpenBSD vendor errata for affected 6.6 systems.; Upgrade OpenBSD systems beyond affected releases where possible.; Limit local shell access to trusted users only..

Prepared

Jun 6, 2026, 03:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.