CVE-2026-49414
HIGHFreeBSD - ASLR Bypass for Setuid Executables via Procctl(2)
Title source: ruleDescription
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.asc
Scores
CVSS v3
7.8
EPSS
0.0011
EPSS Percentile
1.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-179
Status
published
Products (6)
freebsd/freebsd
14.3 (15 CPE variants)
freebsd/freebsd
14.4 (6 CPE variants)
freebsd/freebsd
15.0 (10 CPE variants)
FreeBSD/FreeBSD
14.3-RELEASE - p15
FreeBSD/FreeBSD
14.4-RELEASE - p6
FreeBSD/FreeBSD
15.0-RELEASE - p10
Published
Jun 27, 2026
Tracked Since
Jun 27, 2026