By vendor
Freebsd vulnerabilities
Known CVEs affecting Freebsd products, prioritized by severity, with SEC.co remediation and detection guidance.
9 published vulnerabilities
- CVE-2026-45257HIGH 7.8
A vulnerability in FreeBSD's kernel TLS (KTLS) implementation allows an unprivileged local user to overwrite arbitrary files on the system. The flaw stems from the KTLS receive path decrypting data in place without properly handling file-backed memory. When a user sends a file via sendfile(2) over a loopback connection with KTLS receive enabled, the decryption operation overwrites the original file's contents instead of a private copy. An attacker can exploit this to corrupt or replace critical system files, including setuid binaries, achieving local privilege escalation and potential full system compromise.
- CVE-2026-45258HIGH 7.8
A memory validation flaw in FreeBSD's audio device driver allows unprivileged users to bypass security boundaries and access kernel memory. The `/dev/dsp` device—typically world-readable—permits any local user to exploit an integer overflow in the memory mapping validation logic, enabling them to read and modify kernel data, escalate privileges, or crash the system. The vulnerability exists because the kernel checks an arithmetic sum that can wrap around, making the overflow check unreliable.
- CVE-2026-49412HIGH 7.8
A critical flaw in the FreeBSD kernel's IPv6 multicast filter handling creates a use-after-free vulnerability. When a user configures IPv6 multicast filters, the kernel briefly releases a lock to safely copy filter settings from user memory. During this window, another thread can delete the filter structure entirely. When the kernel reacquires the lock and resumes work, it holds a pointer to memory that has already been freed—a classic use-after-free condition. An unprivileged local user can deliberately trigger this race condition to execute arbitrary code with kernel privileges.
- CVE-2026-49414HIGH 7.8
A timing-of-checks flaw in FreeBSD's ELF image loader allows unprivileged users to disable address space layout randomization (ASLR) on setuid binaries. An attacker can call procctl(2) before execve(2) to disable ASLR, causing the kernel to compute the binary's base address without ASLR protection—even though the flag should have been cleared before that computation. This dramatically reduces the difficulty of exploiting memory corruption bugs in setuid programs that would normally rely on ASLR as a mitigation.
- CVE-2026-49416HIGH 7.8
A flaw in FreeBSD's virtual terminal (vt) driver allows an unprivileged local user to cause a heap buffer overflow by requesting an excessively large console history size. The kernel fails to properly validate the requested size, triggering an integer overflow that causes the system to allocate less memory than needed. When the driver then initializes this undersized buffer, it writes beyond the allocated region, corrupting kernel memory. An attacker with local access to a vt device can exploit this to escalate their privileges.
- CVE-2026-49413HIGH 7.1
FreeBSD's Linuxulator—a compatibility layer that allows Linux binaries to run on FreeBSD—fails to properly mark when a Linux binary is running with elevated privileges (set-user-ID or set-group-ID). An unprivileged local attacker can exploit this by injecting a malicious shared library into such a binary, tricking it into loading untrusted code with the privileges the binary was meant to have. This is a local privilege escalation vulnerability affecting systems that run Linux binaries on FreeBSD and have set-user-ID or set-group-ID Linux executables installed.
- CVE-2026-49417HIGH 7.0
A use-after-free vulnerability in FreeBSD's audio device handling allows unprivileged local users to read and write kernel memory. When an audio device is closed, its backing buffer may be freed while memory mappings remain valid, leaving the process able to access the freed region. Since audio device nodes are world-accessible by default, any local user with access to the system can exploit this to either escalate privileges to gain full system control or crash the kernel, causing a denial of service.
- CVE-2026-45259MEDIUM 6.5
FreeBSD's Capsicum security framework—a capability-based sandboxing system—contains a flaw in how it handles signal delivery. A sandboxed process can use the sigqueue() system call to send signals to other processes on the system, bypassing the sandbox restrictions that should limit its actions. An attacker controlling a compromised sandboxed application could exploit this to disrupt or terminate other processes, potentially escalating impact or degrading system stability.
- CVE-2026-45256MEDIUM 5.5
A permission-checking flaw in FreeBSD's thr_kill2() system call allows unprivileged local users to send signals to processes they shouldn't be able to reach. The kernel performs a permission check but ignores the result before actually delivering the signal, meaning the signal arrives even though it was denied. An attacker with local access can exploit this to stop or crash critical system processes, causing service outages. The vulnerability is made more practical because thread IDs are assigned sequentially and globally, allowing attackers to discover targets through brute-force enumeration without needing detailed system knowledge.