CVE-2026-49414

⚠️ high

Summary

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

CVSS Score

7.8

High

EPSS Score

0.1

Exploit Probability

Published Date

2026-06-27

First Seen: 2026-06-28

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.4% of all 338,295 vulnerabilities in our database.

#103,392

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 29, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Synacktiv

SSVC data provided by CISA

Last Modified 2026-07-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-179

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
freebsd	freebsd	Affected	v14.3
freebsd	freebsd	Affected	v14.4
freebsd	freebsd	Affected	v15.0

🔗 References 1

https://security.freebsd.org/advisories/FreeBSD-SA-2...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-45258	⚠️ high	7.8	0.2	dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the...	2026-06-27
CVE-2026-45259	🔶 medium	6.5	0.1	sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation...	2026-06-27
CVE-2026-49412	⚠️ high	7.8	0.1	The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, ...	2026-06-27
CVE-2026-49413	⚠️ high	7.1	0.1	The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. Durin...	2026-06-27
CVE-2026-49417	⚠️ high	7.0	0.1	Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained va...	2026-06-27
CVE-2026-49416	⚠️ high	7.8	0.1	The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer ...	2026-06-27

These CVEs affect the same products