FreeBSD EUVD-2026-101874

Requires an attacker-controlled process already executing inside a classic (non-VNET) FreeBSD jail on the host; IPv6 must be in use; and a target host service must be listening on the host's IPv6 loopback address (::1). Exploitation is specific to the IPv6 UDP send path for unconnected sockets. Limiting factors: VNET jails are NOT affected (only classic/legacy jails), the attacker needs an existing in-jail foothold rather than pure external network access, and impact is bounded to whatever services are bound to host IPv6 loopback - there is no exposure where hosts run only VNET jails, lack IPv6, or bind no sensitive loopback services.

Signals conflict and must be read together. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 7.5 and implies remote, unauthenticated network exploitation, but the description makes clear the attacker must already be an executing process inside a classic (non-VNET) FreeBSD jail - i.e., local access with some foothold is required, NOT anonymous internet-facing exploitation. This is a material discrepancy: CVSS AV:N/PR:N overstates reachability versus the description, which implies local/in-jail prerequisites - verify scoping against the FreeBSD advisory. Exploitation-probability signals are uniformly low: EPSS is 0.19% (8th percentile), the CVE is not on CISA KEV, and no public exploit code was identified in the provided sources, so there is no public exploit identified at time of analysis. The impact profile (C:N/I:H/A:N) reflects that the flaw lets a jailed process reach host loopback-bound services it should be isolated from, enabling interaction with/manipulation of those services rather than data theft or denial of service. Net assessment: this is a defense-in-depth jail-containment weakness relevant to multi-tenant FreeBSD hosts, not a widespread remotely-wormable priority. It warrants patching on hosts that run untrusted workloads in classic jails, but the headline 7.5 overstates real-world urgency given the in-jail prerequisite, absent exploitation signals, and narrow configuration dependency.

An attacker who has already compromised or legitimately controls a process inside a classic (non-VNET) FreeBSD jail on a multi-tenant host crafts IPv6 UDP datagrams addressed to the loopback address. Because the jail policy fails to rewrite the loopback destination to the jail's primary IPv6 address on the unconnected-socket send path, the datagrams reach host services bound to ::1 that were meant to be isolated, letting the jailed tenant interact with trusted localhost-only daemons. No public exploit code was identified, and exploitation presupposes an existing foothold inside the jail.