FreeBSD
635 CVEs across 13 FreeBSD products. Browse FreeBSD vulnerabilities, severities, and proof-of-concept exploits.
FreeBSD products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58097 | High | 7.8 | 2026-08-26 | mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user… |
CVE-2026-58096 | High | 8.8 | 2026-08-26 | LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would tr… |
CVE-2026-58095 | High | 8.8 | 2026-08-26 | mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a… |
CVE-2026-58094 | High | 7.8 | 2026-08-26 | The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the… |
CVE-2026-58093 | High | 7.0 | 2026-08-26 | The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the s… |
CVE-2026-58092 | High | 8.1 | 2026-08-26 | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array… |
CVE-2026-58091 | High | 7.8 | 2026-08-26 | The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list… |
CVE-2026-58090 | High | 7.8 | 2026-08-26 | The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some err… |
CVE-2026-58089 | High | 7.8 | 2026-08-26 | When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check mea… |
CVE-2026-58088 | High | 7.4 | 2026-08-19 | The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a se… |
CVE-2026-58087 | High | 7.8 | 2026-08-19 | The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized… |
CVE-2026-58086 | High | 8.1 | 2026-08-19 | As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was t… |
CVE-2026-58085 | High | 7.5 | 2026-08-19 | After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The drive… |
CVE-2026-58084 | Medium | 5.5 | 2026-08-19 | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI… |
CVE-2026-58083 | High | 8.4 | 2026-08-19 | While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was c… |
CVE-2026-58082 | Critical | 9.8 | 2026-08-19 | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10… |
CVE-2026-58081 | Critical | 9.8 | 2026-08-19 | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted char… |
CVE-2026-49425 | Medium | 5.5 | 2026-08-19 | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged… |
CVE-2026-49424 | Medium | 5.5 | 2026-08-19 | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unp… |
CVE-2026-49423 | Low | 3.3 | 2026-08-19 | When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including… |
CVE-2026-49431 | Low | 3.3 | 2026-08-19 | The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indi… |
CVE-2026-49430 | High | 7.8 | 2026-08-19 | The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-b… |
CVE-2026-49429 | High | 7.8 | 2026-08-19 | The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the o… |
CVE-2026-49428 | High | 8.4 | 2026-08-19 | Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not p… |
CVE-2026-49427 | High | 8.8 | 2026-08-19 | Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed t… |
CVE-2026-49426 | Low | 3.3 | 2026-08-19 | When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather… |
CVE-2026-49422 | High | 8.4 | 2026-08-19 | The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies… |
CVE-2026-49421 | High | 7.1 | 2026-08-19 | The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path loo… |
CVE-2026-49420 | High | 8.8 | 2026-08-19 | The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whethe… |
CVE-2026-49419 | High | 8.8 | 2026-08-19 | When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail d… |
CVE-2026-49418 | High | 8.8 | 2026-08-19 | When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pa… |
CVE-2026-49415 | High | 8.8 | 2026-08-19 | During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process runnin… |
CVE-2026-49416 | High | 7.8 | 2026-06-27 | The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation… |
CVE-2026-49414 | High | 7.8 | 2026-06-27 | The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. A… |
CVE-2026-49417 | High | 7.0 | 2026-06-27 | Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be re… |
CVE-2026-49413 | High | 7.1 | 2026-06-27 | The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set a… |
CVE-2026-49412 | High | 7.8 | 2026-06-27 | The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this… |
CVE-2026-45259 | Medium | 6.5 | 2026-06-27 | sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a cap… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-45257 | High | 7.8 | 2026-06-26 | The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does no… |
CVE-2026-45256 | Medium | 5.5 | 2026-06-26 | When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the re… |
CVE-2026-45255 | High | 7.5 | 2026-05-21 | When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to s… |
CVE-2026-45254 | Medium | 6.5 | 2026-05-21 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of b… |
CVE-2026-45253 | High | 8.4 | 2026-05-21 | ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to deb… |
CVE-2026-45252 | Medium | 5.5 | 2026-05-21 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended… |
CVE-2026-45251 | High | 7.8 | 2026-05-21 | A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold… |
CVE-2026-39461 | High | 8.8 | 2026-05-21 | libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it… |
CVE-2026-45250 | High | 7.8 | 2026-05-21 | The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supp… |
CVE-2026-42512 | High | 8.1 | 2026-04-30 | As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorr… |
CVE-2026-39457 | High | 7.8 | 2026-04-30 | When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits i… |
CVE-2026-35547 | High | 8.1 | 2026-04-30 | When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to wr… |
CVE-2026-7164 | High | 7.5 | 2026-04-30 | Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attac… |
CVE-2026-7270 | High | 7.8 | 2026-04-30 | An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument… |
CVE-2026-42511 | High | 8.1 | 2026-04-30 | The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the… |
CVE-2026-6386 | Medium | 6.2 | 2026-04-22 | In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled t… |
CVE-2026-5398 | High | 8.4 | 2026-04-22 | The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If th… |
CVE-2026-4748 | High | 7.5 | 2026-04-01 | A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) in… |
CVE-2026-4747 | High | 8.8 | 2026-03-26 | Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer… |
CVE-2026-4652 | High | 7.5 | 2026-03-26 | On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID… |
CVE-2026-4247 | High | 7.5 | 2026-03-26 | When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should… |
CVE-2026-3038 | High | 7.5 | 2026-03-09 | The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage struct… |
CVE-2026-2261 | High | 7.5 | 2026-03-09 | Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached… |
CVE-2025-15576 | High | 7.5 | 2026-03-09 | If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, ja… |
CVE-2025-15547 | High | 8.8 | 2026-03-09 | By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subjec… |
CVE-2025-14769 | High | 7.5 | 2026-03-09 | In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then all… |
CVE-2025-14558 | High | 7.2 | 2026-03-09 | The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to reso… |
CVE-2025-24934 | Medium | 5.4 | 2025-10-22 | Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a loa… |
CVE-2025-0662 | Medium | 4.9 | 2025-01-30 | In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to usersp… |
CVE-2025-0374 | Medium | 6.5 | 2025-01-30 | When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not… |
CVE-2025-0373 | Medium | 6.0 | 2025-01-30 | On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buff… |
CVE-2024-51566 | Medium | 6.5 | 2024-11-12 | The NVMe driver queue processing is vulernable to guest-induced infinite loops. |
CVE-2024-51565 | Medium | 6.5 | 2024-11-12 | The hda driver is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-51564 | High | 7.5 | 2024-11-12 | A guest can trigger an infinite loop in the hda audio driver. |
CVE-2024-51563 | Medium | 6.5 | 2024-11-12 | The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition. |
CVE-2024-51562 | Medium | 6.5 | 2024-11-12 | The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-45289 | High | 7.5 | 2024-11-12 | The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by… |
CVE-2024-39281 | Medium | 5.3 | 2024-11-12 | The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. |
CVE-2024-41721 | High | 8.1 | 2024-09-20 | An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and rem… |
CVE-2024-8178 | High | 8.8 | 2024-09-05 | The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a gues… |
CVE-2024-45063 | High | 8.8 | 2024-09-05 | The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running… |
CVE-2024-43110 | High | 8.8 | 2024-09-05 | The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_sc… |
CVE-2024-43102 | Critical | 10.0 | 2024-09-05 | Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference c… |
CVE-2024-42416 | High | 8.8 | 2024-09-05 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kerne… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privile… |
CVE-2024-45288 | High | 8.4 | 2024-09-05 | A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2024-41928 | High | 8.4 | 2024-09-05 | Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically… |
CVE-2024-7589 | High | 8.1 | 2024-08-12 | A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate withi… |
CVE-2024-6760 | High | 7.5 | 2024-08-12 | A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users… |
CVE-2024-6759 | Medium | 5.3 | 2024-08-12 | When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdi… |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-29937 | Critical | 9.8 | 2024-04-11 | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug tha… |
CVE-2022-23093 | Medium | 6.5 | 2024-02-15 | ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP hea… |
CVE-2022-23092 | High | 8.8 | 2024-02-15 | The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that t… |
CVE-2022-23091 | Medium | 4.0 | 2024-02-15 | A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unpr… |
CVE-2022-23090 | High | 7.7 | 2024-02-15 | The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the referenc… |
CVE-2024-25941 | Low | 3.3 | 2024-02-15 | The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside t… |
CVE-2024-25940 | Medium | 6.3 | 2024-02-15 | `bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any… |
CVE-2022-23089 | Medium | 4.7 | 2024-02-15 | When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An ou… |