CVEvulnerability

CVE-2026-49415

8.8 HIGH Published 2026-08-19 Modified 2026-09-01 Official page ↗
Status
Analyzed
Published
2026-08-19
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-367

Description

During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw the original credentials. An unprivileged local user can exploit this race to modify the address space of a SUID binary before its credentials are elevated, potentially gaining full control of the affected system.

Affected configurations

• freebsd freebsd 14.3 • freebsd freebsd 14.4 • freebsd freebsd 15.0 • freebsd freebsd 15.1

Related

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References