Is CVE-2026-45257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45257 being exploited in the wild.

How severe is CVE-2026-45257?

Informational severity, with a CVSS score of 0, published 26 June 2026.

Which products and versions are affected?

MidnightBSD Project MidnightBSD 4.0+.

Is there a fix for CVE-2026-45257?

A patch was published on 2026-06-09: Correction committed to FreeBSD branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45257 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-45257?

Check whether you run MidnightBSD Project MidnightBSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45257: FreeBSD KTLS arbitrary file overwrite via in-place decryption

CVE-2026-45257 · Severity: info · CVSS 0 · Published 2026-06-26

A vulnerability in the FreeBSD kernel allows a standard user to overwrite files they only have permission to read. By sending a file to themselves over a local network connection using specific kernel features, an attacker can trick the system into writing new data directly into the file's permanent storage. This can be used to modify critical system files, such as the 'su' command, to grant the attacker full administrative (root) control over the server.

Quick answers

Is CVE-2026-45257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45257 being exploited in the wild.
How severe is CVE-2026-45257?: Informational severity, with a CVSS score of 0, published 26 June 2026.
Which products and versions are affected?: MidnightBSD Project MidnightBSD 4.0+.
Is there a fix for CVE-2026-45257?: A patch was published on 2026-06-09: Correction committed to FreeBSD branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45257 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-45257?: Check whether you run MidnightBSD Project MidnightBSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'write-what-where' condition exists in the FreeBSD Kernel TLS (KTLS) implementation. When KTLS receive (RX) is enabled on a loopback TCP socket, the kernel attempts to decrypt incoming TLS records in-place within mbufs. If the sender uses sendfile(2) to transmit data, the mbufs may reference the physical page cache of the underlying file (M_EXTPG or EXT_SFBUF). Because the decryption occurs directly on these file-backed pages via the direct map (DMAP), the plaintext overwrites the original file content in the page cache and is subsequently flushed to disk. An attacker can bypass file system permissions and immutable flags (schg) to modify sensitive binaries like /usr/bin/su. The vulnerability affects systems where kern.ipc.mb_use_ext_pgs is enabled (default on amd64, arm64, and riscv).

Affected products

FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15, 13.0 through 13.4
MidnightBSD MidnightBSD 4.0+

Timeline

2026-05-13: other: Reported to FreeBSD security team
2026-06-09: patched: Correction committed to FreeBSD branches
2026-06-09: advisory: FreeBSD-SA-26:26.ktls published
2026-06-26: disclosed: CVE-2026-45257 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.