Skip to content
OpenAdvisories
High WID-SEC-2026-1871 10 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Jun 9, 2026 · Updated Nov 11, 2026 · Revision 14 · de

Vendor: FreeBSD Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Product: Enterprise Linux Product: FreeBSD OS Product: Linux Product: openSUSE Product: Rocky Linux Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um erweiterte Rechte zu erlangen – möglicherweise sogar Administratorrechte –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder andere, nicht näher definierte Angriffe durchzuführen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 10

  • High 8.2
    CVE-2026-10846

    Insufficient verification that responses belong to a query

    NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the questio…

    NLnet Labs ldns ldns ldns Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45257

    Arbitrary file overwrite via the KTLS receive path

    The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly th…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-45258 Public exploit

    Multiple vulnerabilities in the sound(4) mmap path

    dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narr…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-49412

    Use-after-free bug in the IPV6_MSFILTER socket option handler

    The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale poi…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-49414

    ASLR bypass for setuid executables via procctl(2)

    The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-49416

    Integer overflow in vt(4) CONS_HISTORY ioctl

    The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote…

    FreeBSD FreeBSD
  • High 7.1
    CVE-2026-49413 Public exploit

    Flaw in Linuxulator execution of setugid binaries

    The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for s…

    FreeBSD FreeBSD
  • High 7.0
    CVE-2026-49417 Public exploit

    Multiple vulnerabilities in the sound(4) mmap path

    Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-…

    FreeBSD FreeBSD
  • Medium 6.5
    CVE-2026-45259

    sigqueue(2) missing capability mode restriction

    sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capabi…

    FreeBSD FreeBSD
  • Medium 5.5
    CVE-2026-45256

    Missing permission check in thr_kill2(2)

    When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The sy…

    FreeBSD FreeBSD

Revision history

  1. #14

    Neue Updates von Red Hat aufgenommen

  2. #13

    Neue Updates von Red Hat aufgenommen

  3. #12

    Neue Updates von Red Hat aufgenommen

  4. #11

    Neue Updates von Red Hat aufgenommen

  5. #10

    Neue Updates von Red Hat aufgenommen

  6. #9

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  7. #8

    Neue Updates von Oracle Linux, Rocky Enterprise Software Foundation und Red Hat aufgenommen

  8. #7

    Neue Updates von Red Hat aufgenommen

  9. #6

    Neue Updates von Red Hat aufgenommen

  10. #5

    Neue Updates von openSUSE aufgenommen

  11. #4

    Referenz(en) aufgenommen: EUVD-2026-39776, EUVD-2026-39780, EUVD-2026-39960, EUVD-2026-39966, EUVD-2026-39965, EUVD-2026-39964, EUVD-2026-39963, EUVD-2026-39962, EUVD-2026-39961

  12. #3

    PoC für CVE-2026-45257 aufgenommen

  13. #2

    Referenz(en) aufgenommen: EUVD-2026-35991

  14. #1

    Initiale Fassung

References