FreeBSD EUVD-2026-26353

Exploitation requires authenticated local access with low-privileged user account credentials (shell access) on a FreeBSD system running vulnerable kernel versions (13.5 prior to p13, 14.3 prior to p12, 14.4 prior to p3, or 15.0 prior to p7). The attacker must execute programs and invoke the execve(2) system call with crafted arguments, which is permitted for standard user accounts in default FreeBSD configurations. Attack succeeds from local interactive sessions, SSH connections, or within FreeBSD jails. Limiting factors include requirement for authenticated access (PR:L excludes unauthenticated network attackers) and local attack vector (AV:L excludes remote exploitation). No user interaction required (UI:N) and low attack complexity (AC:L) once local access obtained. Systems with restricted user capabilities via MAC policies, disabled local logins, or no unprivileged user accounts have reduced exposure.

This vulnerability presents a critical privilege escalation pathway but with significant practical constraints that reduce immediate widespread risk. CVSS 7.8 (High) reflects the complete system compromise potential (C:H/I:H/A:H) but requires local access (AV:L) and low-privileged authentication (PR:L). The EPSS score of 0.02% (5th percentile) is notably low despite the high CVSS, indicating security researchers and attackers have not prioritized this vulnerability for exploitation attempts. CISA SSVC framework assessment shows 'Exploitation: none' confirming no detected active exploitation, though 'Automatable: yes' suggests exploitation could be scripted once a working proof-of-concept is developed. The 'Technical Impact: partial' designation in SSVC appears inconsistent with CVSS impact ratings (all High) - this discrepancy may reflect SSVC's focus on system-level impact versus CVSS's process-level perspective. Real-world risk is moderate: attackers need existing local access, limiting this to insider threats, compromised user accounts, or chained attacks. The operator precedence bug class (CWE-783) is rare and typically requires deep kernel expertise to exploit reliably. Priority should be elevated for multi-user FreeBSD systems, jails, or environments where untrusted users have shell access. For single-user workstations or systems with strict access controls, risk is substantially lower. No public exploit code identified at time of analysis, raising the barrier to opportunistic exploitation.

An attacker with a low-privileged shell account on a multi-user FreeBSD server crafts a malicious program that invokes execve(2) with specially constructed argument arrays. By carefully sizing and positioning these arguments, the attacker triggers the operator precedence bug, causing a buffer overflow that overwrites adjacent kernel memory containing execution context data. The overflow injects attacker-controlled values that escalate process privileges to root during the exec transition, granting complete system control. No public exploit code exists, but the operator precedence bug class is well-understood by kernel security researchers.