What is the CVSS score of CVE-2026-7164?

CVE-2026-7164 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FreeBSD pf are affected by CVE-2026-7164?

CVE-2026-7164 is a remote denial-of-service vulnerability in FreeBSD's packet filter that allows unauthenticated attackers to crash systems via malformed SCTP packets, affecting any FreeBSD…

How to fix or mitigate CVE-2026-7164?

Within 24 hours: Identify all FreeBSD systems running pf (check 'pfctl -s info' output) and document versions; prioritize systems exposed to untrusted networks. Within 7 days: Apply vendor-released patches (FreeBSD 13.5, 14.3, 14.4, or 15.0 depending on current version); alternatively, implement rate-limiting on SCTP (IP protocol 132) at upstream network devices or disable pf if operationally feasible. Within 30 days: Conduct post-patch validation; review firewall ruleset to confirm SCTP handling rules and consider restricting SCTP traffic to known-legitimate sources.

FreeBSD pf CVE-2026-7164

EUVD-2026-26352 HIGH

Uncontrolled Recursion (CWE-674)

2026-04-30 freebsd

Buffer Overflow Freebsd

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 14:23 vuln.today

CVSS changed

Apr 30, 2026 - 14:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 08:15 euvd

EUVD-2026-26352

Analysis Generated

Apr 30, 2026 - 08:15 vuln.today

CVE Published

Apr 30, 2026 - 07:23 nvd

HIGH 7.5

DescriptionCVE.org

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.

Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

AnalysisAI

Remote denial-of-service in FreeBSD packet filter (pf) allows unauthenticated attackers to crash systems via malformed SCTP packets. Unbounded recursion in SCTP chunk parameter parsing triggers stack overflow, causing kernel panic on any FreeBSD system with pf enabled, regardless of firewall ruleset configuration. EPSS score of 0.06% (17th percentile) suggests low broad exploitation probability, but impact is critical for exposed FreeBSD firewalls. Official patch released by FreeBSD covering versions 13.5, 14.3, 14.4, and 15.0.

Technical ContextAI

The vulnerability resides in FreeBSD's packet filter (pf) SCTP (Stream Control Transmission Protocol) parsing code. SCTP is a transport-layer protocol used for reliable message-oriented communication, commonly in telecommunications and signaling applications. The pf firewall parses SCTP chunk parameters to perform stateful inspection and filtering. The flaw (CWE-674: Uncontrolled Recursion) allows specially crafted SCTP packets with malicious chunk parameter structures to trigger unbounded recursive function calls during validation. Unlike typical buffer overflows that corrupt heap or stack data through sequential writes, this recursion exhaustion consumes stack space with each recursive call until the kernel stack is depleted. When stack space is exhausted, the FreeBSD kernel panics (crashes), causing complete system unavailability. The affected component is the kernel-level pf firewall module, meaning exploitation occurs in privileged kernel context. The CPE identifier cpe:2.3:a:freebsd:freebsd confirms this affects the FreeBSD operating system itself, specifically the integrated pf packet filtering subsystem inherited from OpenBSD.

RemediationAI

Apply FreeBSD security patches immediately: upgrade to FreeBSD 13.5-RELEASE-p13, 14.3-RELEASE-p12, 14.4-RELEASE-p3, or 15.0-RELEASE-p7 as appropriate for your release branch. Patching instructions and binary updates available at https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc following FreeBSD's standard security update procedures via freebsd-update or source rebuild. For systems unable to patch immediately, implement compensating controls with understanding of operational impact: disable pf entirely if not required for security policy (removes firewall protection entirely), or configure upstream network devices to block SCTP protocol (IP protocol 132) at network perimeter before reaching vulnerable FreeBSD systems (breaks legitimate SCTP applications like SIP, Diameter, or SS7 signaling). If SCTP filtering is feasible, use access control lists on border routers or IDS/IPS to drop malformed SCTP packets, though deep packet inspection for recursive parameter structures may not be reliable. None of these workarounds substitute for patching, as they either eliminate critical firewall functionality or may impact legitimate SCTP-based services.