Executive brief
A vulnerability in the FreeBSD kernel's FUSE file system module could allow a malicious user to crash the system or access sensitive information. FUSE is a component that allows non-standard file systems to run on the computer. If an attacker is able to run a specially crafted file system daemon, they could read private kernel memory or potentially gain higher privileges on the system.
Technical details
A heap-based buffer overflow exists in the FreeBSD fusefs kernel module during the handling of FUSE_LISTXATTR messages. The vulnerability is caused by the kernel calling strlen() on a daemon-supplied buffer containing a list of extended attributes without first validating that the strings are properly NUL-terminated as required by the FUSE protocol. An attacker capable of running a FUSE daemon (which requires root privileges by default, or unprivileged access if vfs.usermount is enabled) can provide a malformed response to trigger an out-of-bounds read or write. This can result in the disclosure of up to 253 bytes of kernel heap memory or the injection of up to 250 bytes into unallocated kernel heap space. The issue is addressed in FreeBSD 15.0-RELEASE-p9, 14.4-RELEASE-p5, and 14.3-RELEASE-p14.
Affected products
- FreeBSD Project FreeBSD 15.0-STABLE, 15.0-RELEASE-p9, 14.4-STABLE, 14.4-RELEASE-p5, 14.3-RELEASE-p14
Timeline
- 2026-05-20: patched: Fixes committed to stable and release branches.
- 2026-05-20: advisory: FreeBSD Security Advisory FreeBSD-SA-26:20.fusefs published.
- 2026-05-21: disclosed: CVE-2026-45252 published to NVD.