FreeBSD EUVD-2026-39966

Requires local, unprivileged shell access to an affected FreeBSD host and the ability to invoke procctl(2) before execve(2) - the concrete prerequisite is calling PROC_ASLR_CTL to request ASLR disable, then executing a target that is BOTH setuid AND built as a position-independent executable (PIE). The flaw is only useful in practice when chained with a separate memory-corruption vulnerability in that setuid binary; on its own it grants no code execution or privilege gain. Limiting factors: it is not remotely exploitable (AV:L), it depends on the presence of a setuid PIE binary that is also separately vulnerable, and it requires the attacker already hold a local account (PR:L), so single-user, non-interactive, or fully patched systems are not at risk.

Signals are consistent and point to a real-but-secondary risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) correctly reflects an unprivileged local user with no user interaction, and the 7.8 base score is driven by C:H/I:H/A:H - but those high impacts represent the downstream RCE that becomes possible, not a direct effect of this flaw, which by itself only removes a defense-in-depth mitigation and grants no code execution. EPSS is low (0.18%, 8th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, all of which align: this is a useful exploitation primitive, not a standalone weaponizable bug. The practical priority is moderate - it elevates the severity of any other memory-corruption vulnerability in a setuid binary, so it should be patched on multi-user FreeBSD hosts, but it does not warrant emergency response on single-user or hardened deployments. Note the discrepancy to weigh: the headline 7.8/H-H-H impact assumes a chained second vulnerability, so treating this in isolation as a full RCE would overstate its standalone danger.

An unprivileged user with shell access on a multi-user FreeBSD server who has discovered (or is chaining) a memory-corruption bug in a local setuid root binary calls procctl(2) to disable ASLR, then execve(2)s the setuid binary, which now loads at a predictable base address. With randomization removed, the attacker reliably crafts ROP/return-to-libc payloads against the second vulnerability to escalate to root. No public exploit for this specific flaw is identified at time of analysis, and the low attack complexity means the primitive is trivial to invoke once a chaining bug is available.