Skip to content
OpenAdvisories
High WID-SEC-2026-1628 7 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published May 20, 2026 · Updated May 21, 2026 · Revision 2 · de-DE

Vendor: FreeBSD Product: FreeBSD OS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Programmcode mit Administratorrechten auszuführen, und um Informationen offenzulegen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 7

  • High 8.8
    CVE-2026-39461

    select(2) file descriptor set overflow causes stack overflow

    libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SE…

    FreeBSD FreeBSD
  • High 8.4
    CVE-2026-45253

    Missing validation in ptrace(PT_SC_REMOTE)

    ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no sp…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-45250 Public exploit

    Stack buffer overflow via setcred(2)

    The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length.…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-45251

    Kernel use-after-free via file descriptor syscalls

    A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the th…

    FreeBSD FreeBSD
  • High 7.5
    CVE-2026-45255

    Remote code execution via installer Wi-Fi access point scans

    When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names …

    FreeBSD FreeBSD
  • Medium 6.5
    CVE-2026-45254

    Incorrect libcap_net limitation list manipulation

    In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of netwo…

    FreeBSD FreeBSD
  • Medium 5.5
    CVE-2026-45252

    Heap overflow in FUSE_LISTXATTR

    When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-t…

    FreeBSD FreeBSD

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-31256, EUVD-2026-31257, EUVD-2026-31254, EUVD-2026-31264, EUVD-2026-31263, EUVD-2026-31258

  2. #1

    Initiale Fassung

References