Description Summary:
A kernel operator precedence error leads to a buffer overflow, enabling an unprivileged user to potentially gain superuser privileges.

Executive Summary:
A critical buffer overflow vulnerability in the FreeBSD kernel allows local unprivileged users to escalate privileges to superuser status.

Vulnerability Details

CVE-ID: CVE-2026-7270

Affected Software: FreeBSD Kernel

Affected Versions: FreeBSD 15.0-RELEASE (prior to p7), 14.4-RELEASE (prior to p3), 14.3-RELEASE (prior to p12), and 13.5-RELEASE (prior to p13).

Vulnerability: The flaw is caused by an operator precedence logic error (CWE-783) within the kernel. This allows an attacker with low local privileges to trigger a buffer overflow that overwrites adjacent execve(2) argument buffers.

Business Impact

Successful exploitation of this vulnerability grants an attacker full root-level control over the affected system. Given the CVSS score of 7.8, this represents a significant risk, as it permits complete compromise of data confidentiality, integrity, and system availability. Such an escalation could lead to total unauthorized system takeover, persistent backdoor installation, and potential lateral movement across the network.

Remediation Plan

Immediate Action: Apply the security patches provided by the FreeBSD project immediately by updating the system kernel to the specified patched releases.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected privilege escalation attempts.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict access controls on the file system to limit the ability of low-privileged users to interact with sensitive kernel interfaces.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as evidenced by the repository identified in the enrichment data.

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation in the wild. However, the availability of a public proof-of-concept necessitates prompt patching to prevent local attackers from abusing the flaw for privilege escalation.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the potential for total system compromise via privilege escalation. IT administrators should prioritize the deployment of the FreeBSD security updates listed above. Failure to remediate this issue leaves systems susceptible to local attacks that bypass standard security boundaries.

Description Summary:
Incorrect packet validation in the FreeBSD SCTP implementation allows remote attackers to trigger unbounded recursion, leading to a system panic and denial of service.

Executive Summary:
A critical vulnerability in the FreeBSD kernel's SCTP packet parsing allows unauthenticated remote attackers to crash systems via a stack overflow.

Vulnerability Details

CVE-ID: CVE-2026-7164

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE (up to p7), 14.4-RELEASE (up to p3), 14.3-RELEASE (up to p12), 13.5-RELEASE (up to p13)

Vulnerability: This flaw involves uncontrolled recursion (CWE-674) during the parsing of SCTP chunk parameters. An unauthenticated remote attacker can send crafted packets to trigger a stack overflow and subsequent system panic, regardless of the pf ruleset configuration.

Business Impact

The potential for a remote system panic presents a significant risk to service availability and operational continuity. With a CVSS score of 7.5, this vulnerability is categorized as High, reflecting the ease of exploitation over the network without requiring authentication. Successful exploitation results in an immediate denial of service, potentially impacting critical infrastructure or internet-facing services relying on FreeBSD.

Remediation Plan

Immediate Action: Update affected FreeBSD systems to the patched releases identified in the FreeBSD security advisory (FreeBSD-SA-26:14.pf).

Proactive Monitoring: Monitor system logs for kernel panics or unexpected reboots, and inspect network traffic for anomalous SCTP packets that deviate from expected protocol behavior.

Compensating Controls: While a WAF may not filter deep kernel-level protocol parsing, ensure that perimeter firewalls are configured to drop unsolicited or malformed SCTP traffic where such traffic is not explicitly required for business operations.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its reach, as it impacts any system where the packet filter is active, regardless of the specific firewall rules applied.

Analyst Recommendation

Given the ease of exploitation and the potential for a complete system crash, administrators should prioritize the application of the vendor-provided patches. Immediate patching is the only definitive way to eliminate the vulnerability. If immediate patching is not feasible, restrict network access to the affected SCTP services to trusted sources only.

Description Summary:
A heap-based buffer overflow in the ppp(8) utility's mp_SetEnddisc() function allows a local user to crash the service or achieve arbitrary code execution with root privileges.

Executive Summary:
A heap-based buffer overflow in the FreeBSD ppp(8) utility allows a local authenticated attacker to potentially gain root-level code execution.

Vulnerability Details

CVE-ID: CVE-2026-58097

Affected Software: FreeBSD FreeBSD

Affected Versions: FreeBSD 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: The vulnerability exists in the mp_SetEnddisc() function, which fails to perform length validation on a user-supplied PSN endpoint value. A local user with access to the ppp(8) command interface can trigger this heap-based buffer overflow to crash the utility or execute arbitrary code with root privileges.

Business Impact

Successful exploitation of this flaw grants an attacker full control over the affected system by elevating local privileges to root. Given the CVSS score of 7.8, the risk is classified as High: it represents a significant threat to system integrity and confidentiality. Unauthorized root access can lead to complete system compromise, data theft, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update to FreeBSD 15.1-RELEASE p3, 15.0-RELEASE p13, 14.4-RELEASE p9 or later, or apply the specific source patch provided in the FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unexpected crashes of the ppp(8) utility and review command history for signs of unauthorized interaction with the ppp(8) interface.

Compensating Controls: Restrict access to the ppp(8) command interface to only necessary, authorized users to minimize the attack surface until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for local access to the ppp(8) interface acts as a natural barrier to remote exploitation.

Analyst Recommendation

While this vulnerability requires local access, the potential for root-level code execution makes it a high-priority item for system administrators. Organizations should schedule the recommended security updates during the next maintenance window to ensure the ppp(8) utility is properly hardened against buffer overflow attacks.

Description Summary:
The LcpDecodeConfig function in FreeBSD fails to validate the length of endpoint discriminator options, leading to an out-of-bounds write vulnerability in ppp(8).

Executive Summary:
A critical out-of-bounds write vulnerability in the FreeBSD ppp(8) utility allows unauthenticated attackers to trigger system crashes or execute arbitrary code with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-58096

Affected Software: FreeBSD

Affected Versions: 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: This flaw stems from improper length validation during the processing of PPP endpoint discriminator options. An unauthenticated remote attacker can supply malformed packets to trigger an out-of-bounds write, potentially resulting in remote code execution.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical severity and the potential for full system compromise. Successful exploitation grants an attacker root-level access, which can lead to complete loss of confidentiality, integrity, and availability of the affected system. This poses a significant risk to organizational infrastructure that relies on FreeBSD for networking services.

Remediation Plan

Immediate Action: Update the affected FreeBSD systems to the patched release versions (15.1-RELEASE-p3, 15.0-RELEASE-p13, or 14.4-RELEASE-p9) as specified in the official FreeBSD security advisory.

Proactive Monitoring: Review system logs for unusual ppp(8) process crashes or unexpected network traffic patterns that deviate from established baselines.

Compensating Controls: Restrict network access to the PPP service using firewalls or access control lists to ensure that only trusted peers can communicate with the vulnerable component.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for interaction with the ppp(8) daemon means that attack surface is limited to systems where this specific service is exposed and enabled.

Analyst Recommendation

Given the potential for root-level remote code execution, this vulnerability represents a severe threat to system security. Administrators must prioritize the application of vendor-provided patches to the specified FreeBSD versions immediately. Failure to address this flaw leaves critical infrastructure exposed to full system compromise by unauthenticated remote actors.

Description Summary:
A heap-based buffer overflow in the mp_Enddisc function of FreeBSD allows unauthenticated remote attackers to cause a crash or execute arbitrary code with root privileges.

Executive Summary:
A critical heap-based buffer overflow in FreeBSD allows unauthenticated remote attackers to achieve full system compromise via malicious PPP peer communication.

Vulnerability Details

CVE-ID: CVE-2026-58095

Affected Software: FreeBSD

Affected Versions: 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: The mp_Enddisc function performs incorrect length calculations when processing endpoint discriminator addresses, resulting in a heap-based buffer overflow. This flaw can be triggered by an unauthenticated remote attacker sending a specially crafted PPP packet to the ppp(8) utility.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker root-level access, leading to complete system compromise, unauthorized data exfiltration, and potential lateral movement within the network. The ability for an unauthenticated remote attacker to execute arbitrary code with the highest level of privilege poses an extreme risk to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch immediately by updating the affected FreeBSD releases to the specified versions (15.1-RELEASE-p3, 15.0-RELEASE-p13, or 14.4-RELEASE-p9) as detailed in the FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unusual ppp(8) activity or process crashes that might indicate attempted exploitation of this buffer overflow.

Compensating Controls: Restrict network access to the affected ppp(8) services using host-based firewalls or network segmentation to prevent external access from untrusted sources.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires reaching the ppp(8) daemon, the memory corruption nature of this flaw makes it a high-value target for weaponization.

Analyst Recommendation

Given the potential for remote code execution with root privileges, this vulnerability must be treated with the highest priority. Administrators should verify their current FreeBSD release versions and apply the recommended patches immediately to mitigate the risk of full system takeover.

Description Summary:
A time of check time of use race condition in the FreeBSD FIOSSHMLPGCNF ioctl operation allows an unprivileged local user to escalate privileges by configuring conflicting largepage memory settings.

Executive Summary:
A race condition vulnerability in the FreeBSD kernel allows local unprivileged users to escalate privileges, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-58094

Affected Software: FreeBSD

Affected Versions: FreeBSD 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: The vulnerability is a Time of check Time of use (CWE-367) race condition within the FIOSSHMLPGCNF ioctl handler. Because the kernel fails to hold the rangelock during the configuration check, two concurrent processes can trigger inconsistent states in shared memory objects, which an attacker can leverage to gain unauthorized elevated privileges.

Business Impact

The ability for a local unprivileged user to escalate privileges to root level represents a total compromise of system confidentiality, integrity, and availability. With a CVSS score of 7.8, this vulnerability is classified as High severity. Successful exploitation allows an attacker to bypass standard security controls, potentially leading to full system takeover, unauthorized data access, or the deployment of persistent malware.

Remediation Plan

Immediate Action: Administrators must update their FreeBSD systems to the patched versions specified in the vendor advisory (FreeBSD-SA-26:63.posixshm.asc) as soon as possible.

Proactive Monitoring: Security teams should monitor system logs for suspicious process activity, particularly those attempting to invoke ioctl operations on shared memory objects or unusual privilege escalation attempts.

Compensating Controls: While kernel-level race conditions are difficult to mitigate externally, applying strict access controls to prevent untrusted users from executing arbitrary code on the host remains a primary defensive strategy.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its location in the kernel, which allows for reliable local privilege escalation if an attacker can successfully win the race condition.

Analyst Recommendation

Given the potential for complete system compromise, organizations running the affected FreeBSD versions should prioritize this update within their standard patch management lifecycle. The risk of local privilege escalation is significant in multi-user environments or systems where user-space applications are exposed to untrusted input. Apply the provided vendor patches immediately to eliminate the underlying race condition.

Description Summary:
A race condition in the FreeBSD TIOCSCTTY ioctl handler allows local unprivileged users to escalate privileges by linking a terminal that is being destroyed to a process session.

Executive Summary:
A high-severity race condition in the FreeBSD TIOCSCTTY ioctl handler could allow a local unprivileged user to escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-58093

Affected Software: FreeBSD FreeBSD

Affected Versions: FreeBSD 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: The vulnerability is a race condition (CWE-362) and use-after-free (CWE-416) occurring when the TIOCSCTTY ioctl handler fails to revalidate terminal state after dropping and reacquiring locks. This flaw allows an unprivileged local user to manipulate process sessions during terminal destruction.

Business Impact

Successful exploitation allows an unprivileged local user to achieve privilege escalation on the affected system. Given the CVSS score of 7.0, this represents a significant risk to system integrity and confidentiality, as an attacker could gain elevated control over the operating system environment.

Remediation Plan

Immediate Action: Update to FreeBSD 15.1-RELEASE-p3, 15.0-RELEASE-p13, or 14.4-RELEASE-p9 immediately to apply the necessary synchronization fixes.

Proactive Monitoring: Audit system logs for abnormal ioctl activity or unexpected process session behavior that may indicate exploitation attempts.

Compensating Controls: Restrict access to the system to only trusted users, as this vulnerability requires local access to trigger the race condition.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires precise timing for the race condition, which increases the complexity of developing a functional exploit.

Analyst Recommendation

This vulnerability presents a clear path for local privilege escalation. Administrators should prioritize the application of the specified patch versions during the next maintenance window to eliminate the underlying race condition.

Description Summary:
A kernel credential handling flaw in FreeBSD allows authenticated users to elevate privileges to the wheel group through improper group ID transitions in the mac_do function.

Executive Summary:
A critical kernel vulnerability in FreeBSD allows authenticated local users to improperly set their primary group ID to root, potentially leading to unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-58092

Affected Software: FreeBSD FreeBSD

Affected Versions: FreeBSD 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13

Vulnerability: The vulnerability exists in the group_is_primary() function within the kernel, which failed to account for changes in how user credentials represent primary group IDs. This allows an authenticated user with specific mac_do rules to force a transition to an incorrect primary group ID, specifically the wheel group (ID 0).

Business Impact

Successful exploitation of this vulnerability permits an authenticated user to gain elevated privileges, effectively bypassing standard access controls to become a member of the wheel group. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and the potential for complete control over affected FreeBSD instances.

Remediation Plan

Immediate Action: Administrators must update their FreeBSD systems to the patched versions, specifically 15.1-RELEASE-p3 or 15.0-RELEASE-p13, to resolve the logic error in the kernel.

Proactive Monitoring: Review system logs for unusual privilege transitions or unexpected changes in user group memberships, particularly those involving the wheel group.

Compensating Controls: Limit access to mac_do transition rules and restrict user permissions to the minimum necessary to perform their functions until the system can be patched.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the kernel transition logic and requires the existence of specific, potentially non-default mac_do rules to be triggered.

Analyst Recommendation

This vulnerability presents a significant risk to system integrity by allowing unauthorized privilege escalation through kernel-level manipulation. It is imperative that system administrators prioritize the application of the vendor-supplied patches immediately to prevent potential exploitation. Failure to patch these specific kernel versions leaves the system susceptible to local privilege escalation attacks.

Description Summary:
A use-after-free vulnerability in the FreeBSD sound subsystem allows local, unprivileged users to achieve privilege escalation via a race condition in sync group ioctl handling.

Executive Summary:
A high-severity use-after-free vulnerability in the FreeBSD kernel allows local attackers to escalate privileges, necessitating immediate kernel updates.

Vulnerability Details

CVE-ID: CVE-2026-58091

Affected Software: FreeBSD FreeBSD

Affected Versions: 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: The vulnerability is a use-after-free flaw within the sound subsystem ioctl implementation. An unprivileged local user can trigger this condition by racing the lock acquisition process during sync group management, potentially leading to unauthorized privilege escalation.

Business Impact

The ability for a local user to escalate privileges to the kernel level presents a severe risk to system integrity and confidentiality. Successful exploitation could allow an attacker to bypass all OS-level access controls, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 7.8, this vulnerability is categorized as high, reflecting the significant impact on system security despite the requirement for local access.

Remediation Plan

Immediate Action: Administrators must apply the latest security patches provided by the FreeBSD project for the affected release branches to resolve the kernel memory management flaw.

Proactive Monitoring: Monitor system logs for repeated crashes of audio-related services or suspicious use of ioctl calls by non-privileged processes.

Compensating Controls: Restrict access to audio device nodes, such as /dev/dsp, to only authorized users to prevent non-privileged accounts from interacting with the vulnerable kernel driver.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its location in kernel space, which provides a direct path for privilege escalation once the race condition is successfully triggered.

Analyst Recommendation

Given the potential for full system compromise via kernel-level privilege escalation, this issue should be treated with high priority. Organizations running the affected FreeBSD versions should verify their current patch level and apply the vendor-supplied updates as soon as they are available to prevent local exploitation.

Description Summary:
A use-after-free vulnerability in the FreeBSD SOCK_STREAM receive path allows an unprivileged local user to escalate privileges via improper control message handling.

Executive Summary:
A high-severity use-after-free vulnerability in the FreeBSD kernel allows local attackers to achieve privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-58090

Affected Software: FreeBSD

Affected Versions: 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13

Vulnerability: This is a use-after-free vulnerability (CWE-416) occurring within the unix socket implementation, specifically the SOCK_STREAM receive path. An unprivileged local user can trigger this flaw to manipulate memory and escalate their privileges on the host system.

Business Impact

The ability for a local user to escalate privileges to root level presents a critical threat to the confidentiality, integrity, and availability of the affected system. While the CVSS score of 7.8 reflects the local nature of the attack, the impact is total, potentially allowing an attacker to bypass all security controls, access sensitive data, or install persistent backdoors.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches by updating to FreeBSD 15.1-RELEASE-p3 or 15.0-RELEASE-p13 or later.

Proactive Monitoring: Monitor system logs for unusual kernel crashes or attempts by non-privileged accounts to interact with sensitive socket operations.

Compensating Controls: Restrict local shell access to trusted users and implement strict kernel-level auditing to detect unauthorized privilege escalation attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for local access necessitates that security teams focus on hardening local user environments and ensuring timely kernel patching.

Analyst Recommendation

This vulnerability represents a significant security risk for FreeBSD environments due to the potential for full system compromise. Security administrators should prioritize the deployment of the provided patches in the next maintenance window to eliminate the risk of local privilege escalation.

Description Summary:
An improper check in the FreeBSD hwpmc module allows local users to continue monitoring processes after they execute setuid or setgid binaries, bypassing intended security policies.

Executive Summary:
An improper privilege check in the FreeBSD hwpmc module allows unprivileged local users to monitor restricted processes, leading to potential information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-58089

Affected Software: FreeBSD FreeBSD

Affected Versions: FreeBSD 15.1-RELEASE up to (excluding) p3, 15.0-RELEASE up to (excluding) p13, 14.4-RELEASE up to (excluding) p9

Vulnerability: This vulnerability (CWE-273) exists because the hwpmc(4) subsystem fails to properly detach Performance Monitoring Counters (PMCs) when a process executes a setuid or setgid image. An unprivileged local user can maintain monitoring access to these elevated processes, violating security boundaries.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high risk of unauthorized information disclosure and potential privilege escalation. By monitoring sensitive processes, an attacker could capture secrets, cryptographic keys, or other confidential data that is otherwise protected by setuid or setgid mechanisms.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches by updating to FreeBSD 15.1-RELEASE-p3, 15.0-RELEASE-p13, or 14.4-RELEASE-p9.

Proactive Monitoring: Review system performance monitoring configurations and monitor for unauthorized usage of the hwpmc(4) interface.

Compensating Controls: Limit access to PMC interfaces if not required for system operations, and audit user permissions to prevent unauthorized execution of monitoring tools.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent design logic error in the privilege check process.

Analyst Recommendation

This issue undermines the security of setuid and setgid binaries, which are fundamental to system security. It is highly recommended that affected systems be updated to the latest patched versions to restore correct privilege enforcement for the hwpmc subsystem.

Description Summary:
A use-after-free vulnerability in the FreeBSD TIOCNOTTY implementation allows a local attacker to gain root privileges via a dangling pointer.

Executive Summary:
A critical use-after-free vulnerability in the FreeBSD kernel, identified as CVE-2026-5398, permits local unauthenticated attackers to escalate privileges to root.

Vulnerability Details

CVE-ID: CVE-2026-5398

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to p6, 14.4-RELEASE up to p2, 14.3-RELEASE up to p11, 13.5-RELEASE up to p12

Vulnerability: This is a use-after-free flaw (CWE-416) within the TIOCNOTTY terminal handling code, which fails to clear a back-pointer to the process session. An unauthenticated local attacker can leverage this dangling pointer after the process exits to trigger memory corruption and achieve full root access.

Business Impact

The ability for a local user to gain root privileges represents a total compromise of system integrity and confidentiality. Given the CVSS score of 8.4, this vulnerability poses a severe risk to any environment where multi-tenancy or untrusted local access is permitted, as it facilitates complete bypass of system security controls.

Remediation Plan

Immediate Action: Update FreeBSD systems to the patched releases specified in the FreeBSD-SA-26:10.tty security advisory.

Proactive Monitoring: Monitor system logs for unusual kernel panics or repeated crash events that may indicate exploitation attempts.

Compensating Controls: Restrict local shell access to authorized users only, as the vulnerability requires local execution to trigger the memory corruption.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as a local kernel privilege escalation makes it a high-value target for attackers who have already gained initial low-privileged access to a system.

Analyst Recommendation

This vulnerability is highly critical due to the potential for total system compromise via local privilege escalation. Administrators must prioritize patching affected FreeBSD kernels to the versions specified in the vendor advisory immediately, as there are no effective mitigations that prevent the underlying memory corruption issue without a code fix.

Description Summary:
A stack-based buffer overflow in the FreeBSD libalias RTSP handler allows for memory corruption due to missing length checks when rewriting outgoing packets.

Executive Summary:
A stack-based buffer overflow in the FreeBSD libalias component could lead to arbitrary code execution or system instability when processing malformed RTSP packets.

Vulnerability Details

CVE-ID: CVE-2026-49420

Affected Software: FreeBSD FreeBSD

Affected Versions: 15.1-RELEASE (before p1), 15.0-RELEASE (before p11), 14.4-RELEASE (before p7), 14.3-RELEASE (before p16)

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the libalias RTSP handler. It occurs because the software fails to validate if rewritten packet data fits within the allocated stack buffer, allowing an unauthenticated attacker on the local network segment (AV:A) to trigger a memory corruption event.

Business Impact

Successful exploitation results in significant security impact, including potential remote code execution and system crashes. Given the CVSS score of 8.8, this vulnerability poses a severe threat to infrastructure stability and data confidentiality for any organization relying on FreeBSD libalias for packet processing.

Remediation Plan

Immediate Action: Apply the vendor security updates provided in FreeBSD-SA-26:41.libalias to all affected release versions immediately.

Proactive Monitoring: Monitor network traffic for malformed RTSP packets or unusual spikes in system crashes related to the libalias component.

Compensating Controls: Deploy firewall rules to restrict access to RTSP services and ensure that only authorized traffic is allowed to reach vulnerable network interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires local network access, the nature of the flaw as a buffer overflow makes it a prime target for weaponization.

Analyst Recommendation

FreeBSD administrators should treat this vulnerability with high urgency due to the risk of memory corruption and potential code execution. Updating to the patched releases identified in the security advisory is the only effective way to remediate this flaw and ensure the continued security of the FreeBSD environment.

Description Summary:
A regression in FreeBSD packet filter (pf) hash calculation causes rules using address range syntax to be silently ignored, potentially leading to security policy bypass or overblocking.

Executive Summary:
A high-severity flaw in the FreeBSD packet filter subsystem can cause security rules to be silently dropped, potentially resulting in unauthorized network access.

Vulnerability Details

CVE-ID: CVE-2026-4748

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p5, 14.4-RELEASE up to (excluding) p1, 14.3-RELEASE up to (excluding) p10

Vulnerability: This vulnerability involves an incorrect hash calculation in the pf subsystem, which causes rules containing specific address range syntax to be discarded as duplicates. This flaw is unauthenticated, as it resides in the core packet filtering logic of the operating system.

Business Impact

The failure of the packet filter to load intended security rules directly undermines network segmentation and perimeter defense. Depending on the specific rules affected, this could lead to the unintended exposure of internal services or the denial of service for legitimate traffic. With a CVSS score of 7.5, this issue represents a significant risk to network integrity and compliance requirements.

Remediation Plan

Immediate Action: Administrators must update their FreeBSD systems to the patched versions provided in the FreeBSD-SA-26:09.pf security advisory.

Proactive Monitoring: Review current pf rule sets to identify if address range syntax is in use and verify that all rules are correctly loaded using the pfctl -sr command.

Compensating Controls: If immediate patching is not possible, audit firewall configurations to replace range-based syntax with CIDR blocks where applicable, as these remain unaffected by the regression.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the rule-parsing logic of the packet filter, making it a reliable target for an attacker who can determine the specific rule set of the target system.

Analyst Recommendation

Given the critical role of the packet filter in FreeBSD security, this regression poses a substantial risk to system isolation. Administrators are advised to prioritize the application of the vendor-supplied patches to ensure that all security policies are enforced as intended. Failure to remediate may leave network segments exposed due to the silent failure of security rules.

Description Summary:
A vulnerability exists in the RPCSEC_GSS data packet validation routine where signature checks are improperly handled. This flaw could allow attackers to bypass security mechanisms.

Executive Summary:
A high-severity vulnerability in SAP's RPCSEC_GSS implementation could allow an attacker to undermine the integrity of authenticated communications by exploiting flaws in the packet signature validation routine.

Vulnerability Details

CVE-ID: CVE-2026-4747

Affected Software: SAP Software (RPCSEC_GSS)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the routine responsible for validating the cryptographic signatures of RPCSEC_GSS data packets. Based on the technical context, an attacker could potentially inject or modify packets without detection, suggesting a failure in the authentication and integrity layer of the RPC service.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized data manipulation or the execution of unauthorized commands within the SAP environment. Given the CVSS score of 8.8, this is classified as a High-severity risk that threatens the fundamental trust and security of the communication protocol used for critical business processes. Failure to remediate could result in significant data integrity loss or system compromise.

Remediation Plan

Immediate Action: Apply the specific SAP security notes and patches associated with this CVE immediately to ensure packet validation routines are correctly implemented.

Proactive Monitoring: Organizations should monitor network traffic for anomalous RPCSEC_GSS packets and review system logs for signature validation failure errors which may indicate exploitation attempts.

Compensating Controls: Implement network segmentation to restrict access to SAP RPC services and utilize encrypted VPN tunnels for all remote administrative traffic to provide an additional layer of security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score of 8.8 and the criticality of the affected component in SAP environments, the potential for exploitation remains significant.

Analyst Recommendation

The high CVSS score and the nature of the RPCSEC_GSS protocol make this a priority for any organization running SAP infrastructure. It is strongly recommended that administrators prioritize this update in the current patching cycle to prevent potential bypasses of communication security.

Description Summary:
The FreeBSD KTLS receive path improperly decrypts records in place, leading to potential memory corruption due to unsafe mbuf modification.

Executive Summary:
A critical vulnerability in the FreeBSD Kernel TLS (KTLS) subsystem allows for potential memory corruption, posing a significant risk to system stability and security.

Vulnerability Details

CVE-ID: CVE-2026-45257

Affected Software: FreeBSD FreeBSD

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists in the KTLS receive path, which incorrectly assumes that mbufs holding received data are anonymous and safe to modify during in-place decryption. This flaw can be triggered by an attacker to cause memory corruption, potentially leading to a kernel panic or unauthorized information disclosure.

Business Impact

With a CVSS score of 7.8, this high-severity vulnerability represents a significant risk to the availability and integrity of FreeBSD systems. Successful exploitation could lead to system crashes (Denial of Service) or potential privilege escalation, directly impacting business operations and the confidentiality of processed network data.

Remediation Plan

Immediate Action: Monitor official FreeBSD security advisories and apply the provided kernel patches or system updates as soon as they become available.

Proactive Monitoring: Review system logs for kernel-related errors or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the affected services where possible and ensure that intrusion detection systems are configured to flag anomalous traffic patterns targeting the kernel network stack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects the core kernel network stack, the risk of system-wide compromise is elevated. Administrators should prioritize the deployment of vendor-supplied patches as soon as they are released to ensure the continued integrity and stability of their FreeBSD environments.

Description Summary:
FreeBSD's bsdinstall and bsdconfig utilities are vulnerable to command injection when processing Wi-Fi network names during network scanning, which could lead to arbitrary code execution.

Executive Summary:
A command injection vulnerability in FreeBSD's bsdinstall and bsdconfig utilities allows an attacker within wireless range to execute arbitrary commands with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-45255

Affected Software: FreeBSD bsdinstall and bsdconfig

Affected Versions: FreeBSD 15.0-RELEASE (up to p9), 14.4-RELEASE (up to p5), 14.3-RELEASE (up to p14)

Vulnerability: The vulnerability (CWE-78) occurs when these utilities process Wi-Fi network names (SSIDs) containing malicious characters, which are then passed improperly to bsddialog(1). This is a network-adjacent, unauthenticated vulnerability.

Business Impact

Successful exploitation allows an attacker to gain full control over the system during the installation or configuration process. This is particularly dangerous as these tools often run with elevated (root) privileges, potentially leading to a complete system takeover. The CVSS score of 7.5 reflects the high impact of this vulnerability on system integrity and availability.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the affected FreeBSD releases as specified in the FreeBSD-SA-26:23.bsdinstall advisory.

Proactive Monitoring: Monitor system logs for unauthorized execution of commands within the bsdinstall or bsdconfig contexts.

Compensating Controls: If patching is delayed, avoid performing Wi-Fi network scans in untrusted environments or when the security of the local wireless broadcast is not guaranteed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for the attacker to be in wireless range and the specific timing of the scan makes this a complex but highly impactful exploit.

Analyst Recommendation

System administrators managing FreeBSD environments must ensure that the latest security patches are applied to mitigate this command injection risk. Given the potential for root-level code execution, this should be treated as a high-priority maintenance task for all affected FreeBSD releases.

Description Summary:
A parameter validation error in the ptrace(PT_SC_REMOTE) system call in FreeBSD allows for an out-of-bounds write vulnerability.

Executive Summary:
A high-severity out-of-bounds write vulnerability in the FreeBSD kernel allows local attackers to achieve potential code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-45253

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is an out-of-bounds write (CWE-787) occurring within the ptrace(PT_SC_REMOTE) syscall interface. The vulnerability arises from improper validation of parameters for syscall(2) and __syscall(2), and can be triggered by an unauthenticated local attacker.

Business Impact

The CVSS score of 8.4 reflects a high-severity risk as the vulnerability allows for privilege escalation, data compromise, or complete system denial-of-service. Because this involves kernel-level memory corruption, a successful exploit could result in the total compromise of the host system, rendering standard user-level defenses ineffective.

Remediation Plan

Immediate Action: Update FreeBSD systems to the latest patch release (15.0-RELEASE-p9, 14.4-RELEASE-p5, or 14.3-RELEASE-p14) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual kernel panics, segmentation faults, or unauthorized attempts to utilize the ptrace system call by non-privileged users.

Compensating Controls: Restrict access to the ptrace system call using kernel security modules or hardened configuration settings if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant due to its location in the kernel, making it a prime target for local privilege escalation.

Analyst Recommendation

Given the critical nature of kernel-level vulnerabilities, administrators must prioritize patching affected FreeBSD instances. Apply the provided vendor updates immediately to prevent local attackers from exploiting this memory corruption flaw to gain elevated system access.

Description Summary:
A use-after-free vulnerability in the FreeBSD kernel occurs when a file descriptor is closed while a thread is blocked in a poll(2) or select(2) system call.

Executive Summary:
A use-after-free vulnerability in the FreeBSD kernel could allow an authenticated local attacker to cause system crashes or potentially achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-45251

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is a use-after-free (CWE-416) vulnerability where improper synchronization allows a file descriptor to be closed while a thread is actively waiting on it via poll(2) or select(2). The attacker must have low-level local privileges to trigger the race condition.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to system integrity and availability. Successful exploitation typically leads to kernel panics (Denial of Service), but in complex scenarios, it may allow for elevation of privilege, compromising all data residing on the affected system.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch immediately to address the race condition in the file descriptor handling logic.

Proactive Monitoring: Review system audit logs for frequent, unexplained kernel panics or repeated crashes involving system-level processes.

Compensating Controls: Minimize the number of local users with shell access to reduce the attack surface for this local privilege escalation vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in the kernel are notoriously difficult to weaponize but highly dangerous once a reliable trigger is discovered.

Analyst Recommendation

Kernel-level use-after-free flaws are high-priority security issues. Organizations should perform an emergency maintenance window to apply the FreeBSD security patches to all production servers to mitigate the risk of local privilege escalation.

Description Summary:
A stack-based buffer overflow in the FreeBSD setcred(2) system call allows local users to potentially exceed intended privileges.

Executive Summary:
A stack-based buffer overflow in the FreeBSD setcred(2) system call presents a critical risk of local privilege escalation for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-45250

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is a stack-based buffer overflow (CWE-121) within the setcred(2) system call. While the call is intended for privileged users, the flaw allows for memory corruption that can be triggered by an attacker with low-level local privileges.

Business Impact

The CVSS score of 7.8 underscores the danger of this vulnerability, which allows local users to bypass security boundaries. By corrupting the stack, an attacker can potentially execute arbitrary code with kernel-level privileges, resulting in full system compromise and loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all affected FreeBSD installations to the latest patch release (15.0-RELEASE-p9, 14.4-RELEASE-p5, or 14.3-RELEASE-p14).

Proactive Monitoring: Monitor for suspicious processes executing system calls or attempting to manipulate credentials beyond their assigned capabilities.

Compensating Controls: Limit access to the system to authorized users only and implement strict principle-of-least-privilege configurations to mitigate the impact of a local account compromise.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept repository exists on GitHub.

Analyst Notes: As of May 22, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists on GitHub, so exploitation risk should be treated as credible. The existence of a PoC increases the likelihood of threat actors attempting to weaponize this stack overflow.

Analyst Recommendation

The presence of a public proof-of-concept makes this vulnerability an immediate threat to any environment where local access is provided to users. Patching is required urgently to prevent attackers from leveraging the available PoC to gain administrative control over the underlying operating system.

Description Summary:
A heap-based buffer overflow in the FreeBSD dhclient utility allows unauthenticated remote attackers to trigger a crash or potentially achieve remote code execution via a specially crafted packet.

Executive Summary:
A critical heap-based buffer overflow in FreeBSD dhclient allows unauthenticated remote attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-42512

Affected Software: FreeBSD dhclient

Affected Versions: FreeBSD 15.0-RELEASE up to (excluding) p7, 14.4-RELEASE up to (excluding) p3, 14.3-RELEASE up to (excluding) p12, 13.5-RELEASE up to (excluding) p13

Vulnerability: This vulnerability is a heap-based buffer overflow occurring when dhclient incorrectly calculates memory allocation sizes while building an environment array for dhclient-script. An unauthenticated remote attacker can exploit this by sending a specially crafted packet to the target system.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could lead to full system compromise or service disruption, posing a significant risk to the availability and security of network-facing infrastructure.

Remediation Plan

Immediate Action: Upgrade to the patched versions of FreeBSD as specified in the official FreeBSD-SA-26:15.dhclient advisory to resolve the memory allocation error.

Proactive Monitoring: Monitor system logs for unusual crashes related to the dhclient process and inspect network traffic for anomalous DHCP packets that may indicate exploitation attempts.

Compensating Controls: While no direct virtual patch exists, administrators should restrict network access to the DHCP client to trusted interfaces and utilize host-based firewalls to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown (no confirmed weaponized exploit or public proof-of-concept identified).

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for remote code execution via network input, necessitating prompt patching.

Analyst Recommendation

Given the potential for remote code execution and the critical nature of the dhclient utility, this vulnerability poses a high risk to the integrity of FreeBSD environments. Administrators must prioritize applying the vendor provided security updates immediately to eliminate the buffer overflow condition and prevent potential unauthorized access.

Description Summary:
A failure to escape double-quotes in the BOOTP file field allows for arbitrary dhclient.conf directive injection, potentially leading to remote code execution as root.

Executive Summary:
A critical vulnerability in the FreeBSD dhclient allows an unauthenticated attacker, operating a rogue DHCP server, to execute arbitrary code with root privileges on client systems.

Vulnerability Details

CVE-ID: CVE-2026-42511

Affected Software: FreeBSD dhclient

Affected Versions: 15.0-RELEASE (prior to p7), 14.4-RELEASE (prior to p3), 14.3-RELEASE (prior to p12), 13.5-RELEASE (prior to p13)

Vulnerability: This flaw involves improper neutralization of quoting syntax (CWE-149) within the dhclient lease file, where an unauthenticated attacker can inject arbitrary directives that are subsequently evaluated by dhclient-script during system restart.

Business Impact

The ability for an unauthenticated attacker to achieve root-level code execution poses a severe risk to organizational infrastructure. Successful exploitation could lead to total system compromise, unauthorized data access, and the potential for lateral movement across the network. Given the CVSS score of 7.3, this vulnerability represents a high-severity threat that requires immediate attention to prevent full loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update affected FreeBSD systems to the patched versions specified in the FreeBSD security advisory (FreeBSD-SA-26:12.dhclient).

Proactive Monitoring: Review system logs for unusual dhclient behavior or unexpected modifications to the lease files and dhclient-script configurations.

Compensating Controls: Ensure DHCP traffic is restricted to trusted, authorized servers and implement network segmentation to limit the reach of rogue DHCP servers.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the attack vector requires a rogue DHCP server, the potential for root-level execution makes this an attractive target for sophisticated adversaries.

Analyst Recommendation

Due to the potential for unauthenticated root-level code execution, this vulnerability must be treated with high priority. System administrators should verify their current FreeBSD release versions against the affected list and apply the necessary security patches provided by the vendor immediately. Consistent monitoring of DHCP traffic and adherence to network security best practices will further reduce the risk of exploitation.

Description Summary:
A stack-based buffer overflow in libcasper(3) during UNIX domain socket communication allows local attackers to potentially elevate privileges or cause system crashes.

Executive Summary:
A stack-based buffer overflow in FreeBSD’s libcasper library creates a risk of privilege escalation and system instability for local users.

Vulnerability Details

CVE-ID: CVE-2026-39461

Affected Software: FreeBSD libcasper

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: The vulnerability is a stack-based buffer overflow occurring when libcasper communicates with helper processes via UNIX domain sockets using the select(2) system call. The attack requires local access and low privileges to trigger.

Business Impact

Successful exploitation allows a local attacker to gain elevated privileges, potentially resulting in full system compromise. While the attack requires local access, the CVSS score of 8.8 underscores the severity of the impact on system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches by updating the FreeBSD system to the latest patch level (15.0-p9, 14.4-p5, or 14.3-p14) using freebsd-update.

Proactive Monitoring: Review system logs for unusual process crashes or segmentation faults, which may indicate attempted exploitation of the buffer overflow.

Compensating Controls: Restrict local user access to the system and ensure that only trusted users have the ability to execute code or interact with system-level services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of local exploitation remains a barrier, but the high impact warrants prompt patching.

Analyst Recommendation

Given the potential for privilege escalation, administrators of the affected FreeBSD versions must prioritize the installation of these security updates. Failure to patch could allow local users to bypass security controls and gain unauthorized administrative control over the host.

Description Summary:
A stack-based buffer overflow in libnv allows local attackers to elevate privileges by exploiting improper file descriptor set size validation in select(2) calls.

Executive Summary:
A stack-based buffer overflow vulnerability in the FreeBSD libnv library could allow an authenticated local attacker to achieve privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-39457

Affected Software: FreeBSD libnv

Affected Versions: FreeBSD: 15.0-RELEASE up to (excluding) p7, 14.4-RELEASE up to (excluding) p3, 14.3-RELEASE up to (excluding) p12, 13.5-RELEASE up to (excluding) p13

Vulnerability: The vulnerability exists because libnv fails to verify if a socket descriptor fits within the FD_SETSIZE limit of 1024 when using select(2). An attacker can trigger stack corruption if they can influence the application to allocate large file descriptors, potentially leading to privilege escalation if the application runs with setuid-root privileges.

Business Impact

This flaw carries a CVSS score of 7.8, indicating a high severity risk for local environments. Successful exploitation allows a local user to gain unauthorized elevated privileges, which could lead to full system compromise, data theft, or the execution of arbitrary code with root permissions.

Remediation Plan

Immediate Action: Update FreeBSD systems to the patched releases identified in the FreeBSD security advisory SA-26:16.libnv to resolve the underlying buffer overflow.

Proactive Monitoring: Monitor system logs for unusual process behavior or unexpected crashes in setuid-root applications that utilize libnv.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced for local user accounts to minimize the potential for an attacker to manipulate file descriptor allocations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically constrained by the requirement to manipulate file descriptor allocations and target specific setuid-root applications.

Analyst Recommendation

Given the potential for privilege escalation, this vulnerability poses a significant risk to the integrity and confidentiality of affected FreeBSD systems. Administrators must prioritize applying the vendor-supplied security patches to the relevant FreeBSD releases immediately to eliminate the possibility of stack-based exploitation.

Description Summary:
A heap-based buffer overflow in libnv, caused by improper message size validation, allows for system crashes or potential privilege escalation.

Executive Summary:
A critical heap-based buffer overflow in libnv allows unprivileged users to crash the system or potentially escalate their privileges.

Vulnerability Details

CVE-ID: CVE-2026-35547

Affected Software: libnv

Affected Versions: See vendor advisory

Vulnerability: The library fails to validate message sizes during header processing. This leads to an out-of-bounds write on the heap, which an attacker can leverage to cause a system panic or execute arbitrary code with elevated privileges.

Business Impact

The CVSS score of 9.1 highlights a critical threat. Privilege escalation and system-level instability can lead to unauthorized data access and significant denial-of-service, impacting business continuity for systems relying on this library.

Remediation Plan

Immediate Action: Update all software packages that include the affected version of libnv to the latest patched version.

Proactive Monitoring: Monitor system logs for unexpected crashes or service restarts that may indicate an exploitation attempt.

Compensating Controls: Implement memory protection features (e.g., ASLR, DEP) and restrict access to the specific services that utilize the vulnerable library.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, no active exploitation has been reported. However, the potential for privilege escalation makes this a high-priority update.

Analyst Recommendation

Security teams should identify all applications utilizing the affected version of libnv and coordinate an immediate update cycle. Verify system integrity following any unexpected service restarts.

Description Summary:
A stack-based buffer overflow in the rtsock_msg_buffer function allows unprivileged users to trigger a kernel panic via a crafted routing request.

Executive Summary:
A critical stack buffer overflow vulnerability in the FreeBSD kernel allows unprivileged users to cause a system-wide denial of service through a kernel panic.

Vulnerability Details

CVE-ID: CVE-2026-3038

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p4, 14.3-RELEASE up to (excluding) p9, 13.5-RELEASE up to (excluding) p10, 14.4-RC1

Vulnerability: The flaw exists in the rtsock_msg_buffer function, which fails to validate the length of sockaddr structures before copying them to the stack. This permits an unprivileged user to trigger a 127 byte buffer overflow, which overwrites the stack canary and forces a kernel panic.

Business Impact

The primary impact of this vulnerability is a denial of service, as successful exploitation results in an immediate kernel panic and system crash. While the current mitigation (the stack canary) prevents direct code execution, the potential exists for local privilege escalation if secondary vulnerabilities are used to leak the canary value. Given the CVSS score of 7.5, this poses a significant threat to system availability in multi-user or shared hosting environments.

Remediation Plan

Immediate Action: Update FreeBSD systems to the patched releases identified in the FreeBSD security advisory SA-26:05.route.

Proactive Monitoring: Monitor system logs for repeated, unexplained kernel panics or crashes which may indicate an attempt to trigger this overflow.

Compensating Controls: Restrict access to routing sockets or limit the ability of untrusted users to execute arbitrary code on the host system to reduce the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is inherently exploitable for a denial of service, the current stack canary implementation serves as a robust defense against arbitrary code execution.

Analyst Recommendation

Administrators should prioritize patching as soon as possible to maintain system stability and prevent denial of service attacks. Although the current impact is primarily limited to kernel panics, the potential for future escalation necessitates a proactive maintenance approach to ensure the integrity of the kernel environment.

Description Summary:
A privilege management flaw in FreeBSD allows a jailed root user to escape the chroot environment and access the host filesystem by leveraging the nullfs mount functionality.

Executive Summary:
A vulnerability in FreeBSD enables a privileged jailed user to escape their container and gain full access to the host filesystem, posing a critical risk to system isolation.

Vulnerability Details

CVE-ID: CVE-2025-15547

Affected Software: FreeBSD

Affected Versions: FreeBSD 14.3-RELEASE up to (excluding) p8, 13.5-RELEASE up to (excluding) p9

Vulnerability: This is an improper privilege management issue (CWE-269) occurring within the kernel path lookup logic. A user with root privileges inside a jail configured with the allow.mount.nullfs option can exploit this flaw to escape the jail and access the host or parent jail filesystem.

Business Impact

Successful exploitation of this vulnerability results in a complete compromise of the jail sandbox, allowing an attacker to escape into the underlying host environment. This leads to unauthorized access to sensitive host data, potential privilege escalation, and total system control. With a CVSS score of 8.8, this vulnerability is classified as High, reflecting the severe impact of a container breakout on infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patches by updating to FreeBSD 14.3-RELEASE-p8 or 13.5-RELEASE-p9 as detailed in the FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unusual mount operations or unauthorized attempts to access files outside of established jail boundaries.

Compensating Controls: Disable the allow.mount.nullfs option for all jails where nullfs mounting is not strictly required to minimize the attack surface until patching can be completed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires a privileged user within the jail, the ability to escape the chroot environment makes this a high-priority security concern for multi-tenant or containerized environments.

Analyst Recommendation

Given the severity of a container breakout, administrators must prioritize patching affected FreeBSD systems immediately. Implementing the vendor-provided updates is the only definitive way to resolve the underlying kernel logic error. In environments where immediate patching is not feasible, ensure that jail configurations are audited to restrict the mount capabilities of jailed users.

Description Summary:
A NULL pointer dereference in the FreeBSD tcp-setmss handler allows remote attackers to cause a denial of service by sending maliciously crafted packets.

Executive Summary:
A vulnerability in the FreeBSD tcp-setmss handler permits unauthenticated remote attackers to trigger a system crash, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-14769

Affected Software: FreeBSD

Affected Versions: 14.3-RELEASE up to (excluding) p7, 13.5-RELEASE up to (excluding) p8

Vulnerability: The vulnerability is a NULL pointer dereference (CWE-476) occurring when the tcp-setmss handler incorrectly frees packet data while allowing subsequent rules to process the traffic. This flaw is reachable by unauthenticated remote attackers who can trigger the error condition through specific packet sequences.

Business Impact

The exploitation of this vulnerability leads to a denial of service, which can cause significant operational disruption by crashing network-facing systems. With a CVSS score of 7.5, the impact is rated as High due to the ease of remote execution and the potential for total service unavailability. Organizations relying on FreeBSD for critical infrastructure may face extended downtime until the system is recovered.

Remediation Plan

Immediate Action: Update FreeBSD systems to the patched versions (14.3-RELEASE-p7 or 13.5-RELEASE-p8) as specified in the official FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unexpected kernel panics or service interruptions that correlate with high volumes of TCP traffic.

Compensating Controls: If patching is not immediately feasible, consider disabling the tcp-setmss directive within the ipfw configuration to prevent the triggering of the vulnerable code path.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows an unauthenticated remote attacker to crash the kernel by sending specifically crafted network packets.

Analyst Recommendation

Given the high CVSS score and the potential for remote denial of service, this vulnerability presents a significant stability risk to FreeBSD environments. Administrators should prioritize the application of the vendor-provided security patches to eliminate the underlying NULL pointer dereference and ensure network service continuity.

Description Summary:
The rtsol and rtsold programs fail to validate router advertisement domain search list options, allowing shell command injection via unquoted input passed to resolvconf.

Executive Summary:
A critical command injection vulnerability in FreeBSD rtsol and rtsold programs allows unauthenticated attackers to achieve remote code execution on affected systems.

Vulnerability Details

CVE-ID: CVE-2025-14558

Affected Software: FreeBSD rtsol and rtsold

Affected Versions: FreeBSD 15.0-RELEASE up to (excluding) p1, 14.3-RELEASE up to (excluding) p7, 13.5-RELEASE up to (excluding) p8

Vulnerability: This is an improper input validation flaw (CWE-20) where malicious router advertisement packets containing crafted domain search list options are passed to the resolvconf shell script without proper quoting, leading to arbitrary shell command execution. The vulnerability is network-accessible and does not require user interaction.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the script execution context, potentially leading to full system compromise. Given the CVSS score of 7.2, this represents a significant risk to confidentiality, integrity, and availability. Unauthorized access to network infrastructure or core servers could result in severe data breaches and operational disruption.

Remediation Plan

Immediate Action: Update FreeBSD systems to the patched releases (15.0-RELEASE-p1, 14.3-RELEASE-p7, or 13.5-RELEASE-p8) as specified in the official FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unexpected execution of resolvconf or unusual shell processes spawned by network-related daemons.

Compensating Controls: Restrict network access to untrusted devices and implement ingress filtering to block unsolicited router advertisement messages at the network perimeter.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, and the availability of weaponized exploits via Metasploit and ExploitDB means the exploitation risk should be treated as high and credible. The flaw is inherently dangerous due to the lack of input sanitization in a shell environment.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for remote code execution and the availability of weaponized exploit code. Organizations running the affected FreeBSD versions must prioritize patching immediately. If patching is not immediately feasible, network-level controls to prevent unauthorized router advertisement traffic should be enforced to reduce the attack surface.