Executive brief
FreeBSD's libcasper, a library that allows security-restricted applications to safely access system interfaces, contains a flaw in how it handles internal communications. A local attacker can manipulate the system into using too many file connections, causing the application to crash or behave unexpectedly. If the affected application runs with administrative (root) privileges, this could allow the attacker to gain full control over the system.
Technical details
A stack-based buffer overflow (CWE-121) exists in libcasper(3) due to unsafe use of the select(2) system call. The library uses select(2) to monitor UNIX domain sockets for communication with helper processes but fails to verify if the socket's file descriptor (FD) value is within the FD_SETSIZE (1024) limit. An attacker can exhaust lower-valued FDs (e.g., by opening many files without closing them) before executing a target application, forcing libcasper to use an FD >= 1024. This causes select() to write beyond the bounds of the fixed-size fd_set structure on the stack. If the target application is setuid root, this stack corruption can be leveraged for local privilege escalation. Patches are available for FreeBSD 14 and 15 branches.
Affected products
- FreeBSD Project FreeBSD All supported versions prior to correction dates
Timeline
- 2026-05-20: patched: Fixes committed to stable and release branches.
- 2026-05-20: advisory: FreeBSD-SA-26:22.libcasper published.
- 2026-05-21: disclosed: CVE-2026-39461 published.