What is the CVSS score of CVE-2026-45253?

CVE-2026-45253 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD are affected by CVE-2026-45253?

A local privilege escalation flaw in FreeBSD 14.3, 14.4, and 15.0 allows users with debug process access to escalate privileges to kernel level, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-45253?

Within 24 hours: Audit and inventory all FreeBSD systems running versions 14.3, 14.4, or 15.0; identify all users and service accounts with ptrace() debug permissions. Within 7 days: Restrict debug process access and ptrace() syscalls to essential administrative accounts only; disable PT_SC_REMOTE interface if not operationally required. Within 30 days: Establish monitoring for FreeBSD security advisories; prepare patch deployment procedure and conduct follow-up audit of debug-privileged accounts.

FreeBSD CVE-2026-45253

EUVD-2026-31257 HIGH

Out-of-bounds Write (CWE-787)

2026-05-21 freebsd

GHSA-96wx-9xhw-cf8x

Memory Corruption Buffer Overflow RCE Freebsd

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 15:23 vuln.today

Severity Changed

May 21, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 15:22 NVD

5.9 (MEDIUM) 8.4 (HIGH)

CVE Published

May 21, 2026 - 09:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges.

The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system.

AnalysisAI

Local privilege escalation in FreeBSD via the ptrace(PT_SC_REMOTE) interface allows an unprivileged user with debug access to a process to trigger arbitrary kernel code execution by abusing improperly validated parameters in syscall(2) and __syscall(2) meta-system calls. Affected releases include FreeBSD 14.3, 14.4, and 15.0 prior to their respective patch levels, and no public exploit identified at time of analysis. EPSS exploitation probability is low (0.02%) but the CVSS base score of 8.4 reflects high impact across confidentiality, integrity, and availability once a foothold exists.

Technical ContextAI

The vulnerability lives in the FreeBSD kernel's ptrace(2) facility, specifically the PT_SC_REMOTE operation that allows a debugger to invoke a system call on behalf of a traced process. When the requested syscall is the meta-syscall syscall(2) or __syscall(2) - which take a syscall number as their first argument and dispatch indirectly - the kernel failed to re-validate the chosen syscall number and arguments through the standard syscall entry path. Combined with CWE-787 (out-of-bounds write), this allows a debugger to coerce the kernel into dispatching crafted syscall handlers with attacker-controlled arguments, producing memory corruption inside kernel address space. The affected component is the base FreeBSD operating system per CPE cpe:2.3:a:freebsd:freebsd:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: FreeBSD 14.3-RELEASE-p14, 14.4-RELEASE-p5, or 15.0-RELEASE-p9 (or later) per FreeBSD-SA-26:21.ptrace at https://security.freebsd.org/advisories/FreeBSD-SA-26:21.ptrace.asc; apply via freebsd-update fetch install and reboot to load the patched kernel. If patching must be deferred, restrict who can ptrace processes by raising security.bsd.unprivileged_proc_debug to 0 via sysctl (this prevents non-root users from attaching to their own processes and will break debuggers like lldb/gdb and software that uses ptrace for crash reporting), and constrain access to multi-user shells, untrusted local accounts, and jails where escape into the host kernel would be catastrophic. Avoid running untrusted code on shared hosts until patched; jail or VM isolation does not mitigate this if the attacker is inside the same kernel.