Freebsd
508 CVEs across 13 Freebsd products. Browse Freebsd vulnerabilities, severities, and proof-of-concept exploits.
Freebsd products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49416 | High | 7.8 | 2026-06-27 | The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation… |
CVE-2026-49414 | High | 7.8 | 2026-06-27 | The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. A… |
CVE-2026-49417 | High | 7.0 | 2026-06-27 | Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be re… |
CVE-2026-49413 | High | 7.1 | 2026-06-27 | The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set a… |
CVE-2026-49412 | High | 7.8 | 2026-06-27 | The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this… |
CVE-2026-45259 | Medium | 6.5 | 2026-06-27 | sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a cap… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-45257 | High | 7.8 | 2026-06-26 | The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does no… |
CVE-2026-45256 | Medium | 5.5 | 2026-06-26 | When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the re… |
CVE-2026-45255 | High | 7.5 | 2026-05-21 | When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to s… |
CVE-2026-45254 | Medium | 6.5 | 2026-05-21 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of b… |
CVE-2026-45253 | High | 8.4 | 2026-05-21 | ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to deb… |
CVE-2026-45252 | Medium | 5.5 | 2026-05-21 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended… |
CVE-2026-45251 | High | 7.8 | 2026-05-21 | A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold… |
CVE-2026-39461 | High | 8.8 | 2026-05-21 | libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it… |
CVE-2026-45250 | High | 7.8 | 2026-05-21 | The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supp… |
CVE-2026-42512 | High | 8.1 | 2026-04-30 | As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorr… |
CVE-2026-39457 | High | 7.8 | 2026-04-30 | When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits i… |
CVE-2026-35547 | High | 8.1 | 2026-04-30 | When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to wr… |
CVE-2026-7164 | High | 7.5 | 2026-04-30 | Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attac… |
CVE-2026-7270 | High | 7.8 | 2026-04-30 | An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument… |
CVE-2026-42511 | High | 8.1 | 2026-04-30 | The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the… |
CVE-2026-6386 | Medium | 6.2 | 2026-04-22 | In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled t… |
CVE-2026-5398 | High | 8.4 | 2026-04-22 | The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If th… |
CVE-2026-4748 | High | 7.5 | 2026-04-01 | A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) in… |
CVE-2026-4747 | High | 8.8 | 2026-03-26 | Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer… |
CVE-2026-4652 | High | 7.5 | 2026-03-26 | On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID… |
CVE-2026-4247 | High | 7.5 | 2026-03-26 | When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should… |
CVE-2026-3038 | High | 7.5 | 2026-03-09 | The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage struct… |
CVE-2026-2261 | High | 7.5 | 2026-03-09 | Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached… |
CVE-2025-15576 | High | 7.5 | 2026-03-09 | If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, ja… |
CVE-2025-15547 | High | 8.8 | 2026-03-09 | By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subjec… |
CVE-2025-14769 | High | 7.5 | 2026-03-09 | In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then all… |
CVE-2025-14558 | High | 7.2 | 2026-03-09 | The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to reso… |
CVE-2025-24934 | Medium | 5.4 | 2025-10-22 | Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a loa… |
CVE-2025-0662 | Medium | 4.9 | 2025-01-30 | In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to usersp… |
CVE-2025-0374 | Medium | 6.5 | 2025-01-30 | When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not… |
CVE-2025-0373 | Medium | 6.0 | 2025-01-30 | On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buff… |
CVE-2024-51566 | Medium | 6.5 | 2024-11-12 | The NVMe driver queue processing is vulernable to guest-induced infinite loops. |
CVE-2024-51565 | Medium | 6.5 | 2024-11-12 | The hda driver is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-51564 | High | 7.5 | 2024-11-12 | A guest can trigger an infinite loop in the hda audio driver. |
CVE-2024-51563 | Medium | 6.5 | 2024-11-12 | The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition. |
CVE-2024-51562 | Medium | 6.5 | 2024-11-12 | The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-45289 | High | 7.5 | 2024-11-12 | The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by… |
CVE-2024-39281 | Medium | 5.3 | 2024-11-12 | The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. |
CVE-2024-41721 | High | 8.1 | 2024-09-20 | An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and rem… |
CVE-2024-8178 | High | 8.8 | 2024-09-05 | The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a gues… |
CVE-2024-45063 | High | 8.8 | 2024-09-05 | The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running… |
CVE-2024-43110 | High | 8.8 | 2024-09-05 | The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_sc… |
CVE-2024-43102 | Critical | 10.0 | 2024-09-05 | Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference c… |
CVE-2024-42416 | High | 8.8 | 2024-09-05 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kerne… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privile… |
CVE-2024-45288 | High | 8.4 | 2024-09-05 | A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2024-41928 | High | 8.4 | 2024-09-05 | Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically… |
CVE-2024-7589 | High | 8.1 | 2024-08-12 | A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate withi… |
CVE-2024-6760 | High | 7.5 | 2024-08-12 | A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users… |
CVE-2024-6759 | Medium | 5.3 | 2024-08-12 | When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdi… |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-29937 | Critical | 9.8 | 2024-04-11 | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug tha… |
CVE-2022-23093 | Medium | 6.5 | 2024-02-15 | ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP hea… |
CVE-2022-23092 | High | 8.8 | 2024-02-15 | The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that t… |
CVE-2022-23091 | Medium | 4.0 | 2024-02-15 | A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unpr… |
CVE-2022-23090 | High | 7.7 | 2024-02-15 | The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the referenc… |
CVE-2024-25941 | Low | 3.3 | 2024-02-15 | The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside t… |
CVE-2024-25940 | Medium | 6.3 | 2024-02-15 | `bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any… |
CVE-2022-23089 | Medium | 4.7 | 2024-02-15 | When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An ou… |
CVE-2022-23088 | Critical | 9.8 | 2024-02-15 | The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-F… |
CVE-2022-23087 | High | 8.8 | 2024-02-15 | The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP che… |
CVE-2022-23086 | High | 7.8 | 2024-02-15 | Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size heade… |
CVE-2022-23085 | High | 8.2 | 2024-02-15 | A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memo… |
CVE-2022-23084 | High | 7.5 | 2024-02-15 | The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could… |
CVE-2023-51765 | Medium | 5.3 | 2023-12-24 | sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-6660 | Medium | 6.5 | 2023-12-13 | When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be… |
CVE-2023-6534 | High | 7.5 | 2023-12-13 | In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4… |
CVE-2023-49298 | High | 7.5 | 2023-11-24 | OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace fil… |
CVE-2023-5978 | High | 7.5 | 2023-11-08 | In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constra… |
CVE-2023-5941 | Critical | 9.8 | 2023-11-08 | In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not c… |
CVE-2023-5370 | Medium | 5.5 | 2023-10-04 | On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being in… |
CVE-2023-5369 | High | 7.1 | 2023-10-04 | Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectiv… |
CVE-2023-5368 | Medium | 6.5 | 2023-10-04 | On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dat… |
CVE-2023-4809 | High | 7.5 | 2023-09-06 | In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately… |
CVE-2023-3494 | High | 8.8 | 2023-08-01 | The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports. The interface lets the guest copy a string in… |
CVE-2023-3107 | High | 7.5 | 2023-08-01 | A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |
CVE-2023-0751 | Medium | 6.5 | 2023-02-08 | When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent… |
CVE-2022-27674 | High | 7.5 | 2022-11-09 | Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel cra… |
CVE-2022-23831 | High | 7.5 | 2022-11-09 | Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash re… |
CVE-2022-32264 | High | 7.5 | 2022-09-06 | sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connections. NOTE: This… |
CVE-2021-29632 | High | 7.5 | 2022-01-18 | In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involvi… |
CVE-2011-1075 | Low | 3.7 | 2021-10-19 | FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In parti… |
CVE-2021-29630 | High | 8.1 | 2021-08-30 | In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, an… |
CVE-2021-29631 | High | 7.8 | 2021-08-30 | In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, an… |
CVE-2021-36159 | Critical | 9.1 | 2021-08-03 | libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode imp… |
CVE-2020-7469 | High | 7.5 | 2021-06-04 | In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a… |
CVE-2021-29629 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and… |
CVE-2021-29628 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a… |
CVE-2021-29627 | High | 7.8 | 2021-04-07 | In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing… |