What is the CVSS score of CVE-2026-49416?

CVE-2026-49416 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FreeBSD are affected by CVE-2026-49416?

A vulnerability in FreeBSD's kernel console driver allows local system users to escalate privileges to root.

How to fix or mitigate CVE-2026-49416?

24 hours: Identify all FreeBSD systems in production and assess which have untrusted local users with vt(4) console device access. 7 days: Implement access controls restricting vt(4) device permissions to administrative users only; evaluate disabling vt(4) driver if not operationally required. 30 days: No vendor-released patch identified at time of analysis; monitor FreeBSD security advisories for patch availability and prepare deployment procedures.

FreeBSD CVE-2026-49416

EUVD-2026-39960 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-27 freebsd

GHSA-f3p8-j3ww-gvq7

Buffer Overflow Integer Overflow Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access to a vt(4) device by an unprivileged user (AV:L/PR:L), straightforward overflow trigger (AC:L), and kernel memory corruption enabling root escalation gives full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 20:23 vuln.today

CVSS changed

Jun 29, 2026 - 20:22 NVD

7.8 (HIGH)

CVE Published

Jun 27, 2026 - 09:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation.

An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.

AnalysisAI

Local privilege escalation in the FreeBSD kernel's vt(4) console driver stems from an integer overflow in the CONS_HISTORY ioctl handler, where an unvalidated history-size value undersizes a heap allocation and a subsequent buffer initialization writes past its end. Any unprivileged local user with access to a vt(4) terminal device can corrupt kernel heap memory and potentially escalate to root. Exploitation is local (PR:L) with no public exploit identified at time of analysis and a low EPSS of 0.18% (8th percentile).

Technical ContextAI

The flaw lives in vt(4), FreeBSD's modern virtual terminal/console subsystem, specifically its scrollback history feature exposed through the CONS_HISTORY console ioctl. The root cause is CWE-190 (Integer Overflow or Wraparound): the handler multiplies/computes a buffer size from an attacker-supplied history size without bounds checking, so a sufficiently large value wraps the size calculation and yields a heap allocation smaller than the logically intended buffer. The driver then initializes the buffer assuming the larger requested size, producing a classic heap out-of-bounds write inside kernel address space. The CPE cpe:2.3:a:freebsd:freebsd:*:*:*:*:* identifies the affected component as the FreeBSD base operating system itself rather than a third-party port.

RemediationAI

Apply the FreeBSD-released patches: update to FreeBSD 14.3-RELEASE-p15, 14.4-RELEASE-p6, or 15.0-RELEASE-p10 (or later) per advisory FreeBSD-SA-26:34.vt at https://security.freebsd.org/advisories/FreeBSD-SA-26:34.vt.asc, typically via freebsd-update fetch && freebsd-update install followed by a reboot, or by rebuilding the kernel from corrected sources. Where immediate patching is not possible, reduce exposure by restricting access to vt(4) console/terminal device nodes so untrusted local users cannot open them, and avoid granting shell access to untrusted accounts on affected hosts; on systems that do not require the vt scrollback console, limiting who can reach the physical/virtual console reduces the attack surface. The trade-off of restricting console device access is potential disruption to legitimate local console users and tooling that relies on the history ioctl, so validate in a maintenance window. Patching is strongly preferred over workarounds because the underlying ioctl is part of standard kernel console functionality.