CVE-2026-49416

HighCVSS 7.8/10Last modified Jul 1, 2026

Description

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation.

An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	>= 15.0-RELEASE, < p10; >= 14.4-RELEASE, < p6; >= 14.3-RELEASE, < p15

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:34.vt.ascVendor Advisory

Timeline

Published: Jun 27, 2026
Last modified: Jul 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-494177.0Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memo CVE-2026-494188.8When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid b CVE-2026-494198.8When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before lo CVE-2026-49427.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security CVE-2026-494208.8The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in th CVE-2026-494217.1The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the CVE-2026-494228.4The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacq CVE-2026-494233.3When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in th CVE-2026-494245.5The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the st CVE-2026-494255.5The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struc CVE-2026-494263.3When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYS CVE-2026-494278.8Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCAC