What is the CVSS score of CVE-2026-45254?

CVE-2026-45254 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

FreeBSD CVE-2026-45254

EUVD-2026-31264 MEDIUM

Improper Privilege Management (CWE-269)

2026-05-21 freebsd

GHSA-rx3c-36rq-fgf8

Privilege Escalation Freebsd

6.5

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

cap_net is invoked by locally executing sandboxed processes, not remotely; AV:L and PR:L better reflect required local process control.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:31 vuln.today

CVE Published

May 21, 2026 - 09:34 nvd

UNKNOWN (no severity yet)

CVE Published

May 21, 2026 - 09:34 cve.org

MEDIUM 6.5

DescriptionCVE.org

In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected.

In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.

AnalysisAI

cap_net privilege escalation in FreeBSD allows Capsicum-sandboxed applications to silently expand their own network operation permissions beyond what was explicitly granted. When a sandboxed process submits a new cap_net limit that omits a key present in the previously active limit, the service incorrectly treats the omission as an unrestricted allow-any grant rather than rejecting the request. Affected releases are FreeBSD 15.0-RELEASE before patch 9, 14.3-RELEASE before patch 14, and 14.4-RELEASE before patch 5; no public exploit is identified and EPSS sits at 0.01% (3rd percentile), though SSVC flags the attack as automatable once the preconditions are met.

Technical ContextAI

FreeBSD's Capsicum security framework provides fine-grained capability-based sandboxing for processes. The cap_net service is a Capsicum component that enforces network operation limits on sandboxed processes via a key-value limit structure - each key represents a category of network operation (e.g., bind, connect, DNS resolution) and its value defines what is permitted. CWE-269 (Improper Privilege Management) applies here: when a sandboxed process calls into cap_net to update its active limit, the implementation fails to validate that the new limit is strictly a subset of the old one. A missing key in the new limit should trigger a rejection, but instead the absence is interpreted as an unrestricted grant. This logic inversion in the permission-narrowing check is the root cause. The affected CPE is cpe:2.3:a:freebsd:freebsd:*:*:*:*:*:*:*:* across three release branches.

RemediationAI

Apply vendor-released patches to reach FreeBSD 15.0-RELEASE-p9, FreeBSD 14.3-RELEASE-p14, or FreeBSD 14.4-RELEASE-p5, as documented in FreeBSD Security Advisory FreeBSD-SA-26:24.cap_net (https://security.freebsd.org/advisories/FreeBSD-SA-26:24.cap_net.asc). Systems that do not use Capsicum's cap_net framework for sandboxing are not exposed to this vulnerability and require no action. As a compensating control before patching, administrators can audit and restrict deployment of applications that invoke cap_net limit updates; however, this may disrupt legitimate Capsicum-based sandboxing operations and is not a complete mitigation. No alternative workarounds are documented in available references.