What is the CVSS score of CVE-2026-49417?

CVE-2026-49417 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FreeBSD are affected by CVE-2026-49417?

FreeBSD 14.3, 14.4, and 15.0 systems face a local privilege escalation vulnerability in the sound subsystem that allows unprivileged users with system access to gain full kernel control or cause…

How to fix or mitigate CVE-2026-49417?

Within 24 hours, inventory all FreeBSD 14.3, 14.4, and 15.0 systems with audio devices enabled, paying particular attention to multi-user systems and development environments. Within 7 days, immediately restrict world-readable access to /dev/dsp device nodes using file permissions or disable the OSS audio subsystem entirely via kernel configuration if audio is not required. Within 30 days, establish a patch management strategy by monitoring FreeBSD security advisories for vendor fixes, develop and test patches in non-production environments, and plan for either patched system updates or migration to unaffected FreeBSD versions (13.x or earlier) depending on organizational deployment timelines.

FreeBSD CVE-2026-49417

EUVD-2026-39961 HIGH

Use After Free (CWE-416)

2026-06-27 freebsd

Denial Of Service Use After Free Memory Corruption Freebsd

7.0

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only via /dev/dsp (AV:L), any unprivileged account qualifies since nodes are world-accessible (PR:L), UAF race and heap grooming raise complexity (AC:H), full kernel read/write yields total C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:09 vuln.today

CVE Published

Jun 27, 2026 - 08:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 27, 2026 - 08:48 cve.org

HIGH 7.0

DescriptionCVE.org

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping.

The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).

AnalysisAI

Local privilege escalation in FreeBSD 14.3, 14.4, and 15.0 releases arises from a use-after-free in the sound (OSS) subsystem, where an audio buffer backing a memory mapping is freed on device close while the mapping stays valid, leaving a stale mapping into reusable kernel memory. Because /dev/dsp device nodes are world-accessible by default, any unprivileged local user on a system with an audio device can read and write kernel memory to escalate to full control, or at minimum crash the kernel for denial of service. There is no public exploit identified at time of analysis, KEV shows no active exploitation, and EPSS is low at 0.19%.

Technical ContextAI

The flaw lives in FreeBSD's OSS-compatible sound driver, which exposes PCM audio through /dev/dsp character device nodes and supports mmap() of the DMA/audio buffer so applications can access sample data directly. The root cause is CWE-416 (Use After Free): the kernel frees the audio buffer that backs an active user mapping when the device is closed, but does not tear down or invalidate the mapping, so the freed physical memory can be recycled for unrelated kernel allocations while still reachable through the user's stale virtual mapping. Because a memory mapping grants direct read/write to whatever kernel object subsequently occupies that reused page, this is a powerful primitive rather than a mere info leak. The FreeBSD advisory FreeBSD-SA-26:27.sound.asc is the authoritative source; CPE identifies the affected product as freebsd:freebsd.

RemediationAI

Vendor-released patch: apply the fixed patch levels - FreeBSD 14.3-RELEASE-p15, 14.4-RELEASE-p6, or 15.0-RELEASE-p10 - via 'freebsd-update fetch install' (or rebuild from the corresponding security branch) and reboot, as detailed in FreeBSD-SA-26:27.sound.asc (https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc). If patching must be deferred, the most effective compensating control is to restrict access to the sound device: tighten permissions on the world-accessible /dev/dsp nodes (for example via a devfs.rules ruleset that removes group/other read-write, applied through devfs_system_ruleset in /etc/rc.conf), which blocks unprivileged local users at the cost of breaking legitimate audio access for non-root users. On hosts that do not need audio at all, unload/disable the sound modules (do not load snd_* drivers) so the vulnerable /dev/dsp interface is never created - this fully removes the attack surface with no downside on headless servers. These controls reduce risk only for the local-access vector and are no substitute for the patch.