EUVD-2026-39962Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain unprivileged local account
-
DeliveryOpen world-readable /dev/dsp
-
Exploitmmap with overflowing offset+length
-
InstallBypass bounds check via integer overflow
-
C2Map kernel memory past audio buffer
-
ExecuteRead/write kernel memory
-
ImpactEscalate to root or panic kernel
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access via an unprivileged user account on a FreeBSD host (14.3, 14.4, or 15.0 prior to the patched levels) that has an audio device, with the snd_* sound drivers loaded so that /dev/dsp device nodes exist. Those nodes are world-accessible by default, so no elevated privileges or non-default permission changes are needed to open them - the attacker only needs to be a local user (PR:L). Exploitation is LIMITED to systems where a sound device is actually present: headless servers or appliances without audio hardware, hosts where the sound modules are not loaded, or hosts where /dev/dsp permissions have been hardened are not exploitable. No user interaction is required (UI:N), and the bug is triggered deterministically through a crafted mmap() call (AC:L). |
| Impact | The signals are internally consistent and point to a serious-but-locally-scoped issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) reflects local-only attack surface with low complexity and low privileges, yielding full C/I/A impact - appropriate for a kernel memory read/write primitive. EPSS is low (0.19%, 9th percentile), which is expected for a local-privilege-escalation bug: EPSS models internet-facing mass exploitation, so a low score here does NOT imply low danger on multi-user systems. The vulnerability is NOT in CISA KEV and no public proof-of-concept is referenced, so there is no evidence of active exploitation. Practical risk is highest on shared/multi-user FreeBSD hosts (jails, shell servers, desktops) that have an audio device present; headless servers without a sound device are not exploitable via this path. There is no conflict between the CVSS local vector and the description - both agree this requires local access. |
| Exploit ScenarioDerived | An attacker with an unprivileged shell account on a multi-user FreeBSD desktop or jail host that has a sound card opens the world-readable /dev/dsp node and issues an mmap() with a crafted large offset and length that overflows the bounds check. The resulting mapping lands in kernel memory, which the attacker reads to leak secrets (kernel pointers, credentials) and writes to overwrite a privileged structure, escalating to root; alternatively a malformed mapping simply panics the kernel for denial of service. No public PoC is currently available, and the low attack complexity (AC:L) makes reliable exploitation feasible once the technique is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Local privilege escalation in the FreeBSD kernel sound subsystem lets an unprivileged user map kernel memory outside the audio buffer via an integer-overflow flaw in dsp_mmap_single(). Because /dev/dsp device nodes are world-accessible by default, any local user on a system with an audio device can read and write arbitrary kernel memory, enabling full system compromise or a kernel panic (DoS). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), and FreeBSD has released errata patches.
RemediationAI
Apply the FreeBSD errata patches: upgrade to 14.4-RELEASE-p6, 14.3-RELEASE-p15, or 15.0-RELEASE-p10 (Vendor-released patch per FreeBSD-SA-26:27.sound) using freebsd-update or by rebuilding the kernel from the patched source branch, then reboot so the corrected kernel takes effect. If immediate patching is not possible, the primary compensating control is to restrict access to the sound devices, which are world-accessible by default: tighten permissions on /dev/dsp* via a devfs.rules entry (e.g. set the dsp nodes to mode 0660 owned by an operator group) so only trusted users can open them - the trade-off is that ordinary users lose audio playback and recording. On hosts that do not need audio, unload or blacklist the sound kernel modules (kldunload snd_* and remove them from loader.conf) to eliminate the attack surface entirely, at the cost of disabling sound support. See the advisory at https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc for the authoritative fix details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in FreeBSD's OSS-compatible digital sound processor (DSP) mmap path. When userspace mmap()s a /dev/dsp node, dsp_mmap_single() validates the request by summing the user-supplied 64-bit offset and length and comparing the result against the audio buffer size. That sum can overflow (wrap around), so a sufficiently large offset+length passes the bounds check. The offset is then truncated from 64 to 32 bits when converted to a buffer address, producing a mapping that points past the audio buffer into unrelated kernel memory. It is classified as CWE-125 (Out-of-bounds Read), but the resulting mapping is read/write, so it is also an out-of-bounds write primitive. CPE data (cpe:2.3:a:freebsd:freebsd) identifies the affected product as the base FreeBSD operating system kernel rather than a third-party application.
Know when Freebsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only via world-readable /dev/dsp requiring a local account (AV:L, PR:L); deterministic mmap overflow gives AC:L; arbitrary kernel read/write yields full C:H/I:H/A:H on the same system (S:U).
Primary rating from Vendor (freebsd).
CVSS VectorVendor: freebsd
Lifecycle Timeline
2DescriptionCVE.org
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memory.
The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).
Executive ViewAI
FreeBSD systems across the organization face a local privilege escalation vulnerability (CVE-2026-45258) that could enable users with system access to compromise kernel integrity and achieve full system control. While no public exploit has been identified and EPSS probability is exceptionally low (0.2%), the technical impact severity is high, and all systems with audio devices require immediate patching and access control hardening.
Patch available per vendor advisory. Interim mitigations: restrict /dev/dsp device permissions (chmod 600 or mandatory access controls), disable audio kernel modules on systems where audio is not required, implement file access monitoring and logging for /dev/dsp, limit audio subsystem access to authorized users only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement mess
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEAS
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 1
GitHub PoC
Exploit-DB