Skip to content
OpenAdvisories
High WID-SEC-2026-1324 6 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Apr 29, 2026 · Updated May 3, 2026 · Revision 2 · de-DE

Vendor: FreeBSD Product: FreeBSD OS

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um sich erweiterte Rechte, einschließlich Superuser-Rechte, zu verschaffen, beliebigen Code auszuführen – auch mit Administratorrechten –, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 6

  • High 8.1
    CVE-2026-35547

    Heap overflow in libnv

    When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be …

    FreeBSD FreeBSD
  • High 8.1
    CVE-2026-42511

    Remote code execution via malicious DHCP options

    The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlle…

    FreeBSD FreeBSD
  • High 8.1
    CVE-2026-42512

    Remotely triggerable out-of-bounds heap write in dhclient

    As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun. A specially…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-39457

    Stack overflow via select() file descriptor set overflow

    When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024). An attacker who is able to force a…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-7270 Public exploit

    Local privilege escalation via execve()

    An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges.

    FreeBSD FreeBSD
  • High 7.5
    CVE-2026-7164

    pf can overflow the stack parsing crafted SCTP packets

    Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is conf…

    FreeBSD FreeBSD

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-26353, EUVD-2026-26350, EUVD-2026-26357, EUVD-2026-26352, EUVD-2026-26355, EUVD-2026-26356

  2. #1

    Initiale Fassung

References