Local privilege escalation via execve()

    -     args->endp - args->begin_argv + consume);
    +     args->endp - (args->begin_argv + consume));

I've seen so many mistakes from it, and seen people spend so much pointless and avoidable time deciphering and verifying it, it really doesn't seem worth it (in most code) for the extremely minor character savings.

Nice to randomly encounter our own work here.

Check out our blog post for a fun walkthrough: https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-free...

AI-generated working exploit, write-up and prompts: https://github.com/califio/publications/tree/main/MADBugs/fr...

Calif is just killing it these past couple months. Reminder that Calif is Thai Duong's new firm.

A CVE for exeCVE()

This is from April 28th, it was patched in 15.0R-p7.

Oof that's a pretty big one, I didn't realise but I had already updated anyway.

  memmove(args->begin_argv + extend, args->begin_argv + consume,
      args->endp - args->begin_argv + consume);   // ← bug

[flagged]

> IV. Workaround

> No workaround is available.

Oh dear.

Linux is on their second and FreeBSD is on their first. How many is Windows on?