What is the CVSS score of CVE-2026-39457?

CVE-2026-39457 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD libnv are affected by CVE-2026-39457?

CVE-2026-39457 is a privilege escalation vulnerability in FreeBSD's libnv library that allows authenticated local users to gain root access through setuid-root applications.

How to fix or mitigate CVE-2026-39457?

Within 24 hours: Identify all FreeBSD systems running libnv (standard on FreeBSD 11.0+) and assess exposure to local user accounts. Within 7 days: Apply FreeBSD Security Advisory SA-26:16 patches to all affected stable branches (11.4-RELEASE, 12.4-RELEASE, 13.3-RELEASE, or later patched versions as released). Verify patch application with `freebsd-update install` or `pkg upgrade` depending on deployment model. Within 30 days: Conduct privilege access review to minimize local user accounts with shell access on critical systems.

FreeBSD libnv CVE-2026-39457

EUVD-2026-26356 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-30 freebsd

Stack Overflow Buffer Overflow Freebsd

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 14:24 vuln.today

CVSS changed

Apr 30, 2026 - 14:22 NVD

7.8 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 09:00 euvd

EUVD-2026-26356

Analysis Generated

Apr 30, 2026 - 09:00 vuln.today

CVE Published

Apr 30, 2026 - 08:01 nvd

HIGH 7.8

DescriptionCVE.org

When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024).

An attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption. If the target application is setuid-root, then this could be used to elevate local privileges.

AnalysisAI

Stack corruption in FreeBSD libnv library allows local authenticated attackers to elevate privileges to root when exploiting setuid-root applications. The vulnerability stems from libnv's select(2) implementation failing to validate socket descriptors against FD_SETSIZE limits (1024), enabling descriptor exhaustion attacks that corrupt stack memory. Confirmed by FreeBSD Security Advisory SA-26:16 with patches available across all stable branches. EPSS score of 0.02% indicates low observed exploitation probability, and no active exploitation or public POC identified at time of analysis.

Technical ContextAI

The libnv library in FreeBSD provides a name-value pair serialization mechanism used for IPC and capability mode communication. The vulnerability resides in libnv's socket data exchange routines that use select(2) for I/O multiplexing. The select(2) system call uses a fixed-size bitmap (fd_set) with a hardcoded limit of FD_SETSIZE (1024 descriptors on FreeBSD). When libnv passes a file descriptor number ≥1024 to FD_SET() without validation, it writes beyond the fd_set structure's bounds, corrupting adjacent stack memory. This is a classic CWE-121 stack-based buffer overflow. The attack vector requires forcing target applications to exhaust low-numbered file descriptors, pushing newly opened sockets into the >1024 range. Applications using libnv for privilege separation or running with setuid-root bits become privilege escalation targets. The CPE identifier cpe:2.3:a:freebsd:freebsd confirms this affects the core FreeBSD operating system distribution across multiple release branches.

RemediationAI

Apply vendor-released patches immediately via freebsd-update: FreeBSD 15.0 users upgrade to 15.0-RELEASE-p7, FreeBSD 14.4 to 14.4-RELEASE-p3, FreeBSD 14.3 to 14.3-RELEASE-p12, and FreeBSD 13.5 to 13.5-RELEASE-p13. Run 'freebsd-update fetch install' followed by system reboot to ensure patched libnv library is loaded by all processes. Source-based installations should sync to the appropriate stable branch (stable/15, stable/14, stable/13) and rebuild world per FreeBSD handbook procedures. If immediate patching is infeasible, implement compensating controls: audit and remove unnecessary setuid-root bits from binaries using 'find / -perm -4000 -user root' and apply least-privilege principles; configure resource limits via login.conf to restrict maxproc and openfiles for untrusted users, reducing file descriptor exhaustion attack surface (trade-off: may impact legitimate workloads requiring many descriptors); enable and monitor MAC framework policies (mac_bsdextended) to restrict local user interactions with privileged processes. These mitigations reduce but do not eliminate risk as they depend on correct identification of attack-exposed setuid binaries. Complete advisory with technical details and patch information at https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc.