Executive brief
A vulnerability in the FreeBSD operating system allows a standard user to gain full administrative (root) control over the system. The issue exists in a system component responsible for managing user identity and group permissions. By sending a specially crafted request to this component, an attacker can bypass security checks and execute malicious code with the highest level of system authority.
Technical details
A stack-based buffer overflow exists in the FreeBSD setcred(2) system call. The vulnerability occurs because the kernel copies a user-supplied list of supplementary groups into a fixed-size stack buffer before performing privilege checks or validating the input length. An unprivileged local attacker can provide an oversized list of groups to trigger the overflow. Successful exploitation allows for arbitrary code execution within the kernel context, leading to full local privilege escalation. The issue has been patched in FreeBSD 14.3, 14.4, and 15.0 release branches.
Affected products
- FreeBSD Project FreeBSD All supported versions prior to correction date 2026-05-20
Timeline
- 2026-01-06: patched: Initial correction in stable/15 branch
- 2026-05-20: advisory: FreeBSD-SA-26:18.setcred published
- 2026-05-21: disclosed: CVE-2026-45250 published to NVD