What is the CVSS score of EUVD-2026-31258?

EUVD-2026-31258 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD libcasper are affected by EUVD-2026-31258?

FreeBSD systems running libcasper in versions 14.3, 14.4, and 15.0 face a local privilege escalation vulnerability that can allow low-privileged attackers to gain root-equivalent access.

How to fix or mitigate EUVD-2026-31258?

24 hours: Identify and inventory all FreeBSD systems running versions 14.3, 14.4, and 15.0; document all setuid-root applications present on each host. 7 days: Implement compensating controls including file descriptor limit enforcement (FD_SETSIZE configuration), disable or remove unnecessary setuid-root applications, and enable system call auditing for abnormal file descriptor allocation. 30 days: Monitor FreeBSD security advisories (SA-26:22.libcasper) for patch release notification and establish upgrade path to patched versions when available from FreeBSD.

FreeBSD libcasper EUVD-2026-31258

| CVE-2026-39461 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-21 freebsd

GHSA-pwph-948j-pgvj

Stack Overflow Buffer Overflow Freebsd

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 15:22 vuln.today

Severity Changed

May 21, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 15:22 NVD

5.1 (MEDIUM) 8.8 (HIGH)

CVE Published

May 21, 2026 - 09:20 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024).

An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.

AnalysisAI

Local privilege escalation in FreeBSD's libcasper(3) library affects FreeBSD 14.3, 14.4, and 15.0 releases prior to specified patch levels, where a missing FD_SETSIZE bounds check enables stack corruption when a low-privileged attacker forces a setuid-root application to allocate file descriptors above 1024. Successful exploitation yields root-equivalent privileges on the local host. No public exploit identified at time of analysis and EPSS scores exploitation probability at just 0.02%, but the issue is confirmed by a FreeBSD security advisory (SA-26:22.libcasper).

Technical ContextAI

libcasper(3) is FreeBSD's Capsicum-based privilege-separation framework that splits applications into a sandboxed main process and helper services communicating over UNIX domain sockets. The library uses the legacy select(2) syscall, whose fd_set bitmap is sized by the compile-time FD_SETSIZE constant (1024 on FreeBSD). When libcasper writes the socket file descriptor into the fd_set without first verifying fd < FD_SETSIZE, descriptor values >= 1024 cause writes past the bitmap's allocated bounds. This is a textbook CWE-121 stack-based buffer overflow, since the fd_set is typically declared as a stack-resident structure. The affected CPE is cpe:2.3:a:freebsd:freebsd, and any setuid-root binary linked against libcasper inherits the flaw.

RemediationAI

Vendor-released patch: apply the FreeBSD base-system updates to reach FreeBSD 15.0-RELEASE-p9, 14.4-RELEASE-p5, or 14.3-RELEASE-p14 as appropriate, using freebsd-update fetch install followed by a reboot or at minimum restart of all setuid-root services that link libcasper. The authoritative advisory at https://security.freebsd.org/advisories/FreeBSD-SA-26:22.libcasper.asc provides the patch and source-tree commits. If patching is delayed, compensating controls include lowering the per-process file-descriptor limit via login.conf or sysctl (kern.maxfilesperproc) to a value safely below 1024 so attackers cannot force allocation above FD_SETSIZE - note this can break workloads that legitimately open many descriptors (database servers, network proxies). Auditing and temporarily removing the setuid bit from non-essential libcasper-linked binaries also blocks the privilege-escalation path at the cost of disabling those tools for unprivileged users.