EIP-2026-114738

PRE-CVE

SunOS 5.10 Generic_147148-26 - Local Privilege Escalation

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114738. PoCs published by Marco Ivaldi.

AI-analyzed exploit summary This exploit leverages a buffer overflow in the CheckMonitor() function of the Common Desktop Environment (CDE) dtsession on Solaris 10 to achieve local privilege escalation. It uses the ret-into-ld.so technique to bypass non-executable stack protections and execute shellcode.

Description

SunOS 5.10 Generic_147148-26 - Local Privilege Escalation

Exploits (1)

exploitdb WORKING POC
by Marco Ivaldi · clocalsolaris
https://www.exploit-db.com/exploits/47932

This exploit leverages a buffer overflow in the CheckMonitor() function of the Common Desktop Environment (CDE) dtsession on Solaris 10 to achieve local privilege escalation. It uses the ret-into-ld.so technique to bypass non-executable stack protections and execute shellcode.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Oracle Solaris 10 1/13 (Update 11) and earlier with CDE 2.3.1 or earlier
Auth required
Prerequisites: Local access to a vulnerable Solaris 10 system · Ability to modify .Xdefaults and create files in /tmp
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026