Skip to content
OpenAdvisories
High WID-SEC-2026-3034 17 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Aug 25, 2026 · Updated Aug 25, 2026 · de-DE

Vendor: FreeBSD Product: FreeBSD OS

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um Berechtigungen zu erweitern und möglicherweise Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 17

  • Critical 9.8
    CVE-2026-63073

    Untrusted Sender DN Used as Format String in CMP Response Validation

    Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expecte…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-58095

    ppp(8): incorrect length calculation in mp_Enddisc()

    mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code a…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-58096

    ppp(8): missing length validation in LcpDecodeConfig()

    LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to c…

    FreeBSD FreeBSD
  • High 8.1
    CVE-2026-58092

    Unauthorized credential switching

    In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedi…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58089

    hwpmc fails to detach PMCs during exec credential transitions

    When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58090

    Use-after-free in unix SOCK_STREAM message handling

    The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivi…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58091

    Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

    The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the imp…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58094

    TOCTOU race in POSIX shared memory large page configuration

    The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had a…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58097

    ppp(8): missing length validation in mp_SetEnddisc()

    mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code a…

    FreeBSD FreeBSD
  • High 7.5
    CVE-2026-14457

    RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

    Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys an…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-18798

    QUIC Server May Trigger Double Free When Processing INITIAL Packet

    Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-54874

    Excessive Memory Use Buffering DTLS Records for a Future Epoch

    Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpo…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63072 Public exploit

    Heap Buffer Overflow in CMS Key Unwrapping

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63075

    QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

    Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A rem…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63076

    Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

    Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which i…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.0
    CVE-2026-58093

    Kernel use-after-free via tty ioctls

    The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to t…

    FreeBSD FreeBSD
  • Medium 5.9
    CVE-2026-63074

    CMP Indefinite Cache Growth of ExtraCerts

    Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraC…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #1

    Initiale Fassung

References