EUVD-2026-31258
GHSA-pwph-948j-pgvj
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024).
An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.
AnalysisAI
Local privilege escalation in FreeBSD's libcasper(3) library affects FreeBSD 14.3, 14.4, and 15.0 releases prior to specified patch levels, where a missing FD_SETSIZE bounds check enables stack corruption when a low-privileged attacker forces a setuid-root application to allocate file descriptors above 1024. Successful exploitation yields root-equivalent privileges on the local host. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Identify and inventory all FreeBSD systems running versions 14.3, 14.4, and 15.0; document all setuid-root applications present on each host. 7 days: Implement compensating controls including file descriptor limit enforcement (FD_SETSIZE configuration), disable or remove unnecessary setuid-root applications, and enable system call auditing for abnormal file descriptor allocation. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today