CVE-2026-7270

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.

The bug may be exploitable by an unprivileged user to obtain superuser privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-783

Affected software

VendorProductVersions
FreeBSDFreeBSD>= 15.0-RELEASE, < p7; >= 14.4-RELEASE, < p3; >= 14.3-RELEASE, < p12; >= 13.5-RELEASE, < p13

References

Timeline

Published
Apr 30, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-727007.5The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-CVE-2026-727013.7Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === opCVE-2026-727025.4Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the ReCVE-2026-727036.3The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodCVE-2026-727046.3The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has CVE-2026-727056.3The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a hiCVE-2026-727087.5SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attacCVE-2026-727099.8SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticaCVE-2026-72715.3A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of thCVE-2026-727109.8SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrCVE-2026-727116.3The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvaCVE-2026-727126.5Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by s