EIP-2026-102787

PRE-CVE

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102787. PoCs published by Mohin Paramasivam.

AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in Bash (CVE-2019-18276) where the 'disable_priv_mode' function fails to properly drop privileges. The exploit compiles a shared library that, when loaded via 'enable -f', regains elevated privileges by calling setuid().

Description

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Exploits (1)

exploitdb WORKING POC
by Mohin Paramasivam · bashlocallinux
https://www.exploit-db.com/exploits/47726

This exploit leverages a privilege escalation vulnerability in Bash (CVE-2019-18276) where the 'disable_priv_mode' function fails to properly drop privileges. The exploit compiles a shared library that, when loaded via 'enable -f', regains elevated privileges by calling setuid().

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: GNU Bash < 5.0 Patch 11
No auth needed
Prerequisites: SUID binary of Bash with effective UID not equal to real UID · GCC or equivalent compiler to build the shared library
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026