CVE-2026-49414

Katalog CVE

CVSS 7.8 · High EPSS 0,15%

Kerentanan Incorrect Behavior Order: Early Validation pada freebsd. Skor CVSS 3.1 7.8 (High) menurut CISA ADP.

Deskripsi (NVD)

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

Rincian

Terbit di NVD

27 Juni 2026

Terakhir diubah

1 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-179: Incorrect Behavior Order: Early Validation

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.asc advisory vendor