Researchers publish local privilege escalation exploit targeting OpenBSD 7.9

Security researchers published a local privilege escalation exploit that allows an attacker to gain root permissions on OpenBSD 7.9, The Hacker News reported on October 16, 2026. The technical demonstration uses a chain of vulnerabilities to elevate privileges on local systems running the affected operating system version. [1]

According to The Hacker News, the exploit functions by chaining a shared-memory integer overflow flaw that is roughly 37 years old with a separate kernel flaw. By combining these two issues, the exploit successfully bypasses key defensive measures in the operating system. [1]

The Hacker News reported that the exploit bypasses OpenBSD Kernel Address Randomized Link (KARL) security mechanisms. In addition, the attack successfully neutralizes hardware-level protections including Supervisor Mode Access Prevention (SMAP) and Supervisor Mode Execution Prevention (SMEP). [1]

Rooting and privilege escalation on Unix-like operating systems grant administrative control over system subsystems, allowing execution of code with superuser permissions. Security mechanisms like kernel address randomization and hardware execution protections are designed to prevent local attackers from elevating privileges through memory vulnerabilities. [1][4]