CVE-2026-49416: FreeBSD vt(4) Integer Overflow Privilege Escalation

Technical summary

CVE-2026-49416 is an integer overflow vulnerability (CWE-190) in the FreeBSD kernel's vt(4) virtual terminal driver, specifically in the CONS_HISTORY ioctl handler. When a user supplies a large history size value, the calculation of the required buffer size overflows, resulting in a heap allocation smaller than the requested amount. Subsequent buffer initialization writes beyond the bounds of the allocated region, creating a classic heap overflow condition. The vulnerability requires local access to a vt device and unprivileged user-level execution, making it exploitable by any regular user on affected systems.

Business impact

Privilege escalation on FreeBSD systems via local heap corruption poses a significant risk to multi-user environments, shared hosting platforms, and containerized deployments. A compromised unprivileged account can gain kernel-level access, enabling data theft, system takeover, lateral movement, and persistent compromise. Organizations relying on FreeBSD for services or infrastructure must prioritize remediation to prevent unauthorized privilege escalation and maintain system security boundaries.

Affected systems

This vulnerability affects multiple FreeBSD versions. Consult your FreeBSD vendor advisory or security notices to determine which specific releases in your deployment are vulnerable. The flaw is present in the vt(4) driver, a standard component of FreeBSD's kernel. Any FreeBSD system with virtual terminal support compiled into the kernel is potentially vulnerable if running an affected version.

Exploitability

Exploitation requires an unprivileged local user account and access to a vt device. No network access is needed, and no user interaction is required beyond issuing the malicious ioctl call. The low attack complexity and minimal prerequisites make this a practical privilege escalation vector for local attackers. The vulnerability is not known to be actively exploited in public KEV catalogs as of the publication date, but the straightforward nature of the flaw suggests weaponization is feasible.

Remediation

Apply the latest FreeBSD security patches for your running version. Check the official FreeBSD Security Advisories page and your vendor's security notices for the specific patch version addressing CVE-2026-49416. If patching cannot be deployed immediately, restrict local user access and limit filesystem permissions on vt device nodes (/dev/ttyv* on FreeBSD) to trusted users only. Monitoring and auditing local login attempts and privilege escalation attempts can help detect exploitation attempts.

Patch guidance

Verify the exact patched version for your FreeBSD release against the official FreeBSD security advisories. Patches are typically released as errata updates or maintenance releases. Test patches in a non-production environment first, especially in high-availability deployments, as kernel updates may require system restart. Coordinate patching with your change management and maintenance windows to minimize downtime.

Detection guidance

Monitor system logs for failed or suspicious ioctl calls on vt devices, particularly CONS_HISTORY requests with abnormally large parameters. Enable kernel audit logging if available to capture vt driver interactions. Watch for unexpected privilege escalation events (e.g., processes spawning root shells from unprivileged accounts) that may indicate exploitation. Host-based intrusion detection systems configured to flag unusual local privilege escalation patterns can provide early warning. Kernel panic logs or heap corruption messages in dmesg output may also indicate exploitation attempts.

Why prioritize this

This vulnerability scores 7.8 (HIGH) under CVSS 3.1 due to its local nature, lack of privilege requirements for triggering, and direct impact on confidentiality, integrity, and availability through privilege escalation. While it requires local access, the minimal barriers to exploitation and the critical nature of privilege escalation in multi-user and containerized environments make it a priority for patching. Organizations should address this before lower-impact vulnerabilities in their patch cycle.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: Attack Vector = Local (AV:L); Attack Complexity = Low (AC:L); Privileges Required = Low (PR:L); User Interaction = None (UI:N); Scope = Unchanged (S:U); and impacts on Confidentiality, Integrity, and Availability all marked as High (C:H/I:H/A:H). The high severity is justified because unprivileged local code execution leading to kernel-level corruption is a reliable path to system compromise. The 'Local' attack vector prevents a higher score, but the direct escalation path and ease of exploitation make this a critical priority for affected environments.

Frequently asked questions