What is the CVSS score of CVE-2026-45250?

CVE-2026-45250 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Freebsd are affected by CVE-2026-45250?

FreeBSD users running kernel versions 14.3, 14.4, or 15.0 face a critical local privilege escalation vulnerability that enables any unprivileged user with system access to execute arbitrary code with…

How to fix or mitigate CVE-2026-45250?

Within 24 hours, inventory all systems running FreeBSD 14.3, 14.4, or 15.0 and map local user access policies to identify exposure. Within 7 days, restrict unprivileged local user provisioning, enforce centralized authentication (LDAP/Kerberos), disable unnecessary local console access, and configure audit logging to detect setcred(2) system calls and privilege escalation attempts. Within 30 days, monitor FreeBSD security advisories for patch releases and prioritize upgrades to patched versions, starting with production systems handling sensitive workloads or accepting high volumes of local user access.

Freebsd CVE-2026-45250

EUVD-2026-31252 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-21 freebsd

GHSA-qr94-c32q-xh3q

RCE Buffer Overflow Stack Overflow Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (freebsd) · only source for this CVE.

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:32 vuln.today

CVE Published

May 21, 2026 - 08:37 nvd

UNKNOWN (no severity yet)

CVE Published

May 21, 2026 - 08:37 cve.org

HIGH 7.8

DescriptionCVE.org

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs.

Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.

AnalysisAI

Local privilege escalation in the FreeBSD kernel's setcred(2) system call lets an unprivileged local user overflow a fixed-size kernel stack buffer and potentially execute arbitrary code with kernel privileges. The flaw affects the FreeBSD 14.3, 14.4 and 15.0 release lines and stems from the length of the caller-supplied supplementary groups list being validated only after it has already been copied into the buffer. There is no public exploit identified at time of analysis, the EPSS probability is very low (0.02%), and CISA SSVC records no known exploitation, but the technical impact is rated total.