FreeBSD libalias EUVD-2026-62242

Exploitation requires the attacker to control a host located on the inside (LAN-facing) interface of a FreeBSD NAT gateway running an unpatched version of libalias. The gateway must be performing NAT using either ipfw(4) in-kernel NAT or natd(8), both of which invoke libalias for protocol-aware packet rewriting. The RTSP handler must be active - it is part of libalias by default but is only invoked when RTSP traffic is being processed. No authentication to the gateway itself is required; the attacker simply sends outbound RTSP traffic from the trusted-side network. The primary limiting factors are: (1) AV:A adjacency - the attacker cannot exploit this from the internet without a pre-existing LAN-side presence; (2) the target must be running an affected FreeBSD version using libalias for NAT; and (3) RTSP traffic must be permitted outbound through the NAT, which is non-default in hardened environments that block non-essential application protocols at the firewall.

The CVSS 8.8 score reflects an adjacent-network, unauthenticated, no-interaction attack with full confidentiality, integrity, and availability impact - a profile that warrants urgent triage for any organization operating FreeBSD NAT gateways. The AV:A constraint is the single most important limiting factor: exploitation requires the attacker to already have a presence on the inside (LAN-side) of the NAT gateway, meaning internet-sourced exploitation is not directly possible. That said, even a mid-sized municipal IT team in rybnik running FreeBSD-based firewalls or routers (such as pfSense/OPNsense derivatives built on FreeBSD internals) should treat this as urgent given the kernel or root-level RCE outcome. No EPSS data is available in the provided intelligence, and no CISA KEV listing exists, which suggests exploitation has not yet been observed at scale. However, the simplicity of the attack (AC:L, PR:N, UI:N) and the severity of the impact - kernel RCE when using ipfw NAT - mean that the absence of KEV should not breed complacency. The SSVC technical impact is Total, and the attack is plausibly automatable once inside the adjacent network, increasing urgency for LAN-exposed deployments or shared hosting environments where internal threat actors cannot be fully trusted.

An attacker with a foothold on a host inside a FreeBSD NAT perimeter (via malware, compromised VM, or physical access to the LAN) crafts outgoing RTSP packets with an oversized embedded SDP payload. When the NAT gateway's libalias RTSP handler rewrites the packet, it overflows the fixed stack buffer, overwriting the return address or stack canary. In the ipfw(4) NAT path, this yields code execution in the kernel; in the natd(8) path, it yields code execution as root. No public proof-of-concept has been identified at time of analysis.