OpenBSD through 6.6 allows local users to escalate to root because a check for LDLIBRARYPATH in setuid programs can be defeated by setting a very small RLIMITDATA resource limit. When executing chpass or passwd (which are setuid root), dlsetupenv in ld.so tries to strip LDLIBRARYPATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.

An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration.