What is the CVSS score of CVE-2026-49412?

CVE-2026-49412 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of FreeBSD are affected by CVE-2026-49412?

FreeBSD kernel versions 14.3, 14.4, and 15.0 contain a local privilege escalation vulnerability with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-49412?

Within 24 hours: Identify all systems running FreeBSD 14.3, 14.4, or 15.0; audit local user accounts and disable those not operationally required; document current administrative access. Within 7 days: Disable IPv6 multicast kernel functionality if not business-critical; implement enhanced monitoring for privilege escalation attempts; subscribe to FreeBSD security advisories for patch notification. Within 30 days: Apply vendor-released patches immediately upon availability from FreeBSD; test thoroughly in non-production environment; conduct security validation post-deployment.

FreeBSD CVE-2026-49412

EUVD-2026-39964 HIGH

Use After Free (CWE-416)

2026-06-27 freebsd

Memory Corruption Privilege Escalation Use After Free Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local low-priv account (AV:L/PR:L); AC:H because exploitation requires winning a kernel lock race; full kernel compromise yields C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:27 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

7.8 (None) 7.8 (HIGH)

CVE Published

Jun 27, 2026 - 09:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory.

An unprivileged local user can exploit this use-after-free to escalate privileges.

AnalysisAI

Local privilege escalation in the FreeBSD kernel arises from a use-after-free in the IPv6 multicast source-filter handler (IPV6_MSFILTER), affecting FreeBSD 14.3, 14.4, and 15.0 releases before their respective patch levels. An unprivileged local user can win a race against the handler's dropped-then-reacquired serializing lock to free the multicast filter structure out from under the kernel, corrupting memory to gain root-level control. There is no public exploit identified at time of analysis, and EPSS is very low (0.13%), consistent with CISA SSVC marking exploitation as 'none' and not automatable.

Technical ContextAI

The flaw is in the FreeBSD kernel's socket-option handling for IPv6 multicast (the IPV6_MSFILTER setsockopt path), which manages per-socket source-address filter lists used for multicast group membership (RFC 3678-style source filtering). To copy the variable-length source-filter list from userspace, the handler releases its serializing lock during the copyin and then reacquires it - a classic time-of-check/time-of-use window. This maps to CWE-416 (Use After Free): a concurrent thread can free the multicast filter structure during the unlocked window, so the handler resumes operating on a dangling pointer to reclaimed kernel memory. The affected component is the freebsd:freebsd product per CPE cpe:2.3:a:freebsd:freebsd, specifically the ip6_multicast subsystem named in advisory FreeBSD-SA-26:29.

RemediationAI

Apply the vendor-released patch by updating to the fixed patch level for your branch: FreeBSD 14.3-RELEASE-p15, 14.4-RELEASE-p6, or 15.0-RELEASE-p10 or later, using freebsd-update (binary update) or by recompiling the kernel from the patched source per FreeBSD-SA-26:29 (https://security.freebsd.org/advisories/FreeBSD-SA-26:29.ip6_multicast.asc); a reboot is required for the new kernel to take effect. If immediate patching is not possible, reduce exposure by limiting local/shell access to trusted users only, since exploitation requires a local account - this is the most effective compensating control given the local attack vector, with the trade-off of restricting multi-user or container/jail workloads. There is no documented runtime toggle to disable IPV6_MSFILTER independently, so untrusted-user isolation and prompt patching are the practical mitigations; see also https://vuldb.com/vuln/374473.