EUVD-2026-76106
GHSA-gq6w-h4cf-wpff
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with high complexity (COMPAT_NETBSD32 required, specific iovlen range); scope changed as kernel heap corruption crosses user-to-kernel privilege boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.
AnalysisAI
Use-after-free and double-free conditions in NetBSD's COMPAT_NETBSD32 kernel compatibility layer enable any local low-privilege user to corrupt kernel heap memory or trigger a kernel panic on affected 64-bit systems. The defect in msg_recv_copyin() causes the kernel to execute cleanup deallocation code on the success path - due to a missing return statement - freeing the iovec buffer after it has already been used, then freeing the same allocation again. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a low-privilege local user account on the target host - remote unauthenticated exploitation is not possible; (2) a 64-bit NetBSD installation with the COMPAT_NETBSD32 kernel option compiled and active, enabling 32-bit binary execution; (3) the ability for that user to execute a 32-bit binary, since the vulnerable code path in msg_recv_copyin() is only reachable via 32-bit syscall emulation; (4) recvmsg() called with msg_iovlen set to a value between 9 and IOV_MAX (1024 on standard configurations), which triggers the heap-allocated iovec path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.3 with AV:L/AC:H/PR:L appropriately reflects the local-only attack surface and the non-trivial exploitation conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch documented at https://gnats.netbsd.org/60373, which corrects the missing return statement in msg_recv_copyin() within the COMPAT_NETBSD32 subsystem. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your environment to identify all NetBSD 64-bit systems running COMPAT_NETBSD32, focusing on production infrastructure; consult your system inventory and running kernel configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thro
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attacke
mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitra
CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execut
The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to c
An issue was discovered in the kernel in NetBSD 7.1. Rated medium severity (CVSS 5.3), this vulnerability is no authenti
ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or M
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today