What is the CVSS score of CVE-2026-49414?

CVE-2026-49414 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FreeBSD are affected by CVE-2026-49414?

A local privilege-escalation weakness in FreeBSD's kernel allows any system user to disable address-space layout randomization (ASLR) on privileged binaries, weakening a critical security defense.

How to fix or mitigate CVE-2026-49414?

Within 24 hours: Inventory all FreeBSD systems and identify those with untrusted local users or multi-user shell access; disable non-essential local accounts if possible. Within 7 days: Subscribe to FreeBSD security advisories (freebsd.org/security); review and tighten procctl(2) access controls and kernel hardening options (e.g., kern.unprivileged_proc_debug, security.bsd.hardlink_check_uid). Within 30 days: Apply vendor patch immediately upon release; deploy updated FreeBSD kernel to all affected systems.

FreeBSD CVE-2026-49414

EUVD-2026-39966 HIGH

Incorrect Behavior Order: Early Validation (CWE-179)

2026-06-27 freebsd

Buffer Overflow Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.3 LOW

Local unprivileged trigger (AV:L/AC:L/PR:L) with no direct code execution; the flaw only weakens an integrity mitigation (I:L), so no C/A impact standalone, unlike the vendor's chained 7.8.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:27 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

7.8 (HIGH)

CVE Published

Jun 27, 2026 - 09:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen.

An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

AnalysisAI

Local ASLR bypass in the FreeBSD ELF image activator (kernel) lets an unprivileged user neutralize address-space layout randomization for setuid PIE binaries. By calling procctl(2) to request ASLR disablement before execve(2), the per-process disable flag remains active when the PIE base address is computed, because the activator clears the flag too late. This is a mitigation-weakening flaw that materially eases exploitation of any separate memory-corruption bug in those privileged binaries; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile).

Technical ContextAI

The issue lives in FreeBSD's kernel ELF image activator, the code path that loads ELF executables during execve(2) and lays out their memory, including the randomized base for position-independent executables (PIE). FreeBSD exposes per-process ASLR control via procctl(2) (PROC_ASLR_CTL), allowing a process to request that randomization be disabled. The bug is a classic CWE-179 (incorrect behavior order / improper handling of case sensitivity-adjacent ordering): for setuid binaries the activator was supposed to discard a user-requested ASLR-disable preference, but it cleared those flags after the base address was already computed instead of before. Because setuid execution crosses a privilege boundary, the user's earlier ASLR-disable request should not carry into the more-privileged process - here it does, defeating ASLR specifically for privileged setuid PIE targets.

RemediationAI

Apply the FreeBSD security patches to a fixed level: update to FreeBSD 14.3-RELEASE-p15, 14.4-RELEASE-p6, or 15.0-RELEASE-p10 (or later) as documented in advisory FreeBSD-SA-26:32.elf (https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.asc), typically via freebsd-update fetch install followed by a reboot. Until patching is possible, the most direct compensating control is to reduce the setuid attack surface - audit and remove or disable the setuid bit on non-essential setuid PIE binaries (chmod u-s), accepting that this can break functionality such as ping, su, or passwd for ordinary users and should be tested per binary. Restricting local/interactive access to trusted users also limits exposure since exploitation requires local code execution, but this only narrows the audience rather than closing the flaw. Generic ASLR sysctl tuning is not a reliable mitigation here because the defect specifically reintroduces a user-controlled disable for privileged targets, so patching is strongly preferred over workarounds.