What is the CVSS score of CVE-2026-45258?

CVE-2026-45258 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FreeBSD are affected by CVE-2026-45258?

FreeBSD systems across the organization face a local privilege escalation vulnerability (CVE-2026-45258) that could enable users with system access to compromise kernel integrity and achieve full…

How to fix or mitigate CVE-2026-45258?

24 hours: Inventory FreeBSD systems with audio devices and assess business criticality; restrict /dev/dsp device access (chmod 600 or equivalent ACL) on non-critical systems pending patching. 7 days: Apply FreeBSD errata patches to all affected production and development systems; disable audio kernel modules via rc.conf on systems where audio functionality is not required. 30 days: Confirm full patch deployment across all environments, audit audio device permissions enterprise-wide, and document systems requiring audio functionality for future hardening decisions.

FreeBSD CVE-2026-45258

EUVD-2026-39962 HIGH

Out-of-bounds Read (CWE-125)

2026-06-27 freebsd

Denial Of Service Buffer Overflow Information Disclosure Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only via world-readable /dev/dsp requiring a local account (AV:L, PR:L); deterministic mmap overflow gives AC:L; arbitrary kernel read/write yields full C:H/I:H/A:H on the same system (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:26 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

7.8 (HIGH)

CVE Published

Jun 27, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memory.

The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).

AnalysisAI

Local privilege escalation in the FreeBSD kernel sound subsystem lets an unprivileged user map kernel memory outside the audio buffer via an integer-overflow flaw in dsp_mmap_single(). Because /dev/dsp device nodes are world-accessible by default, any local user on a system with an audio device can read and write arbitrary kernel memory, enabling full system compromise or a kernel panic (DoS). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), and FreeBSD has released errata patches.

Technical ContextAI

The vulnerability lives in FreeBSD's OSS-compatible digital sound processor (DSP) mmap path. When userspace mmap()s a /dev/dsp node, dsp_mmap_single() validates the request by summing the user-supplied 64-bit offset and length and comparing the result against the audio buffer size. That sum can overflow (wrap around), so a sufficiently large offset+length passes the bounds check. The offset is then truncated from 64 to 32 bits when converted to a buffer address, producing a mapping that points past the audio buffer into unrelated kernel memory. It is classified as CWE-125 (Out-of-bounds Read), but the resulting mapping is read/write, so it is also an out-of-bounds write primitive. CPE data (cpe:2.3:a:freebsd:freebsd) identifies the affected product as the base FreeBSD operating system kernel rather than a third-party application.

RemediationAI

Apply the FreeBSD errata patches: upgrade to 14.4-RELEASE-p6, 14.3-RELEASE-p15, or 15.0-RELEASE-p10 (Vendor-released patch per FreeBSD-SA-26:27.sound) using freebsd-update or by rebuilding the kernel from the patched source branch, then reboot so the corrected kernel takes effect. If immediate patching is not possible, the primary compensating control is to restrict access to the sound devices, which are world-accessible by default: tighten permissions on /dev/dsp* via a devfs.rules entry (e.g. set the dsp nodes to mode 0660 owned by an operator group) so only trusted users can open them - the trade-off is that ordinary users lose audio playback and recording. On hosts that do not need audio, unload or blacklist the sound kernel modules (kldunload snd_* and remove them from loader.conf) to eliminate the attack surface entirely, at the cost of disabling sound support. See the advisory at https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc for the authoritative fix details.