{"id":181730,"date":"2026-05-25T20:48:13","date_gmt":"2026-05-25T18:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd"},"modified":"2026-05-25T20:48:13","modified_gmt":"2026-05-25T18:48:14","slug":"7-novyh-uyazvimostej-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","title":{"rendered":"7 new vulnerabilities in FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On May 20, 2026, FreeBSD developers announced the resolution of seven new vulnerabilities in the system. Not all of them are equally dangerous, but some are quite unpleasant.
\n<\/p>\n

<\/p>\n

CVE-2026-45251<\/a> \u2014 use-after-free in select-like syscalls, if their wait lists contain process descriptors (in FreeBSD 15 \u2014 as well as new jail descriptors), and these descriptors were closed in another thread while the waiting syscall was still pending. Apparently, this commit<\/a>, descriptors related to netmap (a driver for accelerated direct access to a network adapter) are also affected, but there is no official information on this. Process descriptors appeared in FreeBSD 9, so the vulnerability has likely existed since then. The official statement indicates that the vulnerability allows for superuser privileges. There is no way to neutralize it without a patch\/update.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45250<\/a> \u2014 incorrect buffer size calculation and subsequent write beyond the buffer in the setcred system call, whereas, despite setcred requiring root privileges, the stack corruption occurs before the privileges are verified and is thus accessible to all. This system call appeared in FreeBSD 14.3 (meaning earlier versions are unaffected) and provides a way to set all user and group identifiers of the current process in one call, instead of combinations of setuid+setgid+setgroups and similar. The vulnerability allows execution of malicious code in the kernel context. There is no way to neutralize it without a patch\/update.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45252<\/a> \u2014 lack of a null terminator check before copying a string received from the fuse daemon into a new buffer. However, there is a check for the maximum copy size, and it is not possible to read more than 253 extra bytes from the kernel memory. Additionally, it is possible to write up to 250 bytes into \"unallocated kernel heap space\". By default, FreeBSD prohibits non-root users from mounting file systems, thus to inject a malicious fuse daemon into the kernel, one must be root. However, if sysctl vfs.usermount=1 \u2014 the system becomes vulnerable to regular users. It is also important to consider the danger of the fuse daemon in a jail, where it could also be root (though this is generally prohibited by default).<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45253<\/a> \u2014 when using ptrace, it was possible to invoke a system call with an incorrect number in a debugged process, leading to the execution of code in the kernel not intended to run as a system call, with potentially severe consequences. If security.bsd.unprivileged_proc_debug=0 is set (which is a good practice for servers in any case, and the system installer even offers to do this optionally), then user and jailed processes will not be able to use ptrace, and thus the vulnerability will remain available only to root.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45255<\/a> — shell command injection with root privileges in bsdinstall\/bsdconfig through the names of malicious wireless networks that were not escaped at the time of viewing their list. To avoid encountering this vulnerability, simply do not view the list of wireless networks from bsdinstall\/bsdconfig.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-39461<\/a>, CVE-2026-45254<\/a> — vulnerabilities in the libcasper library (not in the kernel). This library is designed for safely customizable service provision for processes placed in a sandbox. One of the vulnerabilities is related to stack buffer overflow and stack corruption by organizing file descriptors with large numbers (it was designed for numbers up to 1024 — the default limit for structures for the select syscall). The second vulnerability — the ability to remove imposed restrictions (the ideology of the library is that once imposed restrictions on a process can only be strengthened) cap_net.<\/p>\n

<\/noindex><\/p>\n

The fixed versions of the system are numbered: 14.3-RELEASE-p14, 14.4-RELEASE-p5, and 15.0-RELEASE-p9. It is also worth noting an important point for some: the FreeBSD 13.5 release was recently end-of-life — on April 30, 2026, and there are no official patches for it (or for the 13.x branch in general). However, if for some reason you do not want to rush to upgrade to the 14.x release, patches for version 14.3 are generally suitable for the sources of 13.5, and CVE-2026-45250 for the 13th branch is irrelevant due to the absence of setcred() in it.<\/p>\n

<\/noindex><\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435. CVE-2026-45251 — use-after-free \u0432 select-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u043a\u043e\u043b\u043b\u0430\u0445, \u0435\u0441\u043b\u0438 \u0432 \u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 (\u0432 FreeBSD 15 — \u0435\u0449\u0451 \u043d\u043e\u0432\u044b\u0435 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b jail-\u043e\u0432), \u0438 \u044d\u0442\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u0431\u044b\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044b \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0442\u043e\u043a\u0435 \u043f\u043e\u043a\u0430 \u043e\u0436\u0438\u0434\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u043a\u043e\u043b\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181730","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd477 new vulnerabilities in FreeBSD | ProHoster","description":"On May 20, 2026, FreeBSD developers announced the resolution of seven new vulnerabilities in the system. Not all of them are equally dangerous, but some are quite unpleasant.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd477 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 FreeBSD | ProHoster","og:description":"20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:14+00:00","article:modified_time":"2026-05-25T18:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=181730"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181730\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=181730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=181730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=181730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}