FreeBSD EUVD-2026-62365

Exploitation requires: (1) an unprivileged local account with interactive shell access on the target FreeBSD system - remote unauthenticated exploitation is not possible given AV:L; (2) the ability to call rfork(2) to create a process sharing the parent's VM map, which is permitted to unprivileged users by default on FreeBSD and requires no special configuration; (3) the ability to trigger a core dump in the shared-address-space process, achievable by sending SIGABRT, SIGSEGV, or similar signals; (4) successfully timing a VM map mutation between the kernel's two passes over the map, which is a high-complexity (AC:H) race and may require many attempts. Exploitation is limited to the affected patch levels (14.4-RELEASE <p8, 15.0-RELEASE <p12, 15.1-RELEASE <p2). Systems with no untrusted local users, where core dumps are disabled, or where rfork(2) is policy-restricted have substantially reduced exposure.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately characterizes a locally-scoped but potentially severe vulnerability. AV:L correctly reflects that exploitation requires an existing shell session on the target host; there is no remote attack surface. AC:H is also appropriate - reliably winning a kernel-level race condition between two VM map passes is non-trivial and typically requires repeated attempts and favorable scheduling conditions. PR:N is notable: no elevated privileges are required beyond a standard local user account, since rfork(2) is available to unprivileged processes by default on FreeBSD. The full C:H/I:H/A:H impact triad reflects that a successful kernel heap overflow could overwrite adjacent kernel structures and yield root-equivalent access. EPSS data was not provided in the source intelligence, limiting probabilistic exploitation probability assessment. KEV status is negative and no POC is publicly known, which collectively suggest this has not yet been broadly weaponized. Multi-user FreeBSD deployments - any shared hosting environment, build server, or interactive shell system where untrusted local accounts exist - carry the highest real-world exposure. Single-user workstations, containers without shell access, and systems behind strict network access controls face much lower practical risk, since the race condition cannot be triggered remotely.

An unprivileged attacker with a local shell account calls rfork(2) to create a sibling process sharing the parent's VM map, then induces a core dump in the parent via a signal such as SIGABRT while the sibling simultaneously and rapidly modifies the shared VM map - adding or removing entries. If the sibling's map mutation lands between the kernel's count pass and population pass, the kernel writes program headers past the end of the allocated heap buffer. Repeated timing attempts increase the probability of winning the race, and a successful heap overflow can overwrite adjacent kernel heap metadata or function pointers to escalate to root.