What is CVE-2026-7164?

CVE-2026-7164 is a high-severity vulnerability in FreeBSD, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-04-30.

How severe is CVE-2026-7164?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in FreeBSD

CVE-2026-7164

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Freebsd — versions 14.3, 13.5, 15.0

Weakness classification (CWE)

CWE-674 — Uncontrolled Recursion
CWE-791

References

secteam@freebsd.org (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-7164?: CVE-2026-7164 is a high-severity vulnerability in FreeBSD, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-04-30.
How severe is CVE-2026-7164?: High severity. CVSS v3 base score is 7.5 out of 10.