# CVE-2026-57589: OpenBSD use-after-free in System V semaphore implementation

Source: https://junglewise.ai/threats/cve-2026-57589-openbsd-use-after-free-in-system-v-semaphore-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-57589 · Severity: high · CVSS 7.4 · Published 2026-06-25

A security vulnerability exists in the OpenBSD operating system's handling of System V semaphores, which are tools used by programs to coordinate shared resources. A local attacker with access to the system could exploit this flaw to gain full administrative (root) control over the machine. This could lead to a complete compromise of the system, including unauthorized access to all data and the ability to disrupt operations.

Technologies: [Openbsd](https://junglewise.ai/threats/technologies/openbsd). Vendors: [OpenBSD](https://junglewise.ai/threats/vendors/openbsd).

## Quick answers

**Is CVE-2026-57589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57589 being exploited in the wild.

**How severe is CVE-2026-57589?** High severity, with a CVSS score of 7.4, published 25 June 2026.

**Which products and versions are affected?** Openbsd up to 7.9.

**Is there a fix for CVE-2026-57589?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57589 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-57589?** Check whether you run Openbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in sys/kern/sysv_sem.c within the OpenBSD kernel. The flaw is triggered during a context switch following a tsleep() call in the sys_semget() function. Because the kernel failed to properly track references to semaphore structures, a semaphore could be freed or modified while a process was sleeping, leading to a use-after-free condition when the process resumed. A local attacker can exploit this race condition to execute arbitrary code with kernel privileges, resulting in privilege escalation to root. The fix introduces reference counters for System V semaphores to ensure they are not deallocated while in use.

## Affected products

- OpenBSD OpenBSD up to 7.9

## Timeline

- 2026-06-24: disclosed: CVE published by MITRE
- 2026-06-25: advisory: NVD entry published

## References

- [https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d](https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d)
- [https://openai.com/index/patch-the-planet/](https://openai.com/index/patch-the-planet/)

## Related threats

- [OpenBSD ldapd LDAP Bind authentication confusion attack](https://junglewise.ai/threats/cve-2026-103547-in-ldapd-in-openbsd-7-8-before-errata-057-and-7-9-before-errata)
- [OpenBSD TKIP MIC-failure countermeasure inverted comparison](https://junglewise.ai/threats/cve-2026-56101-openbsd-tkip-mic-failure-countermeasure-inverted-comparison)
- [OpenBSD auth bypass and heap over-read in sppp_pap_input](https://junglewise.ai/threats/cve-2026-55706-openbsd-auth-bypass-and-heap-over-read-in-sppp-pap-input)
- [In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor…](https://junglewise.ai/threats/cve-2026-41285-in-openbsd-through-7-8-the-slaacd-and-rad-daemons-have-an)
- [FreeBSD and NetBSD file integrity bypass in mmap function](https://junglewise.ai/threats/cve-1999-0323-freebsd-and-netbsd-file-integrity-bypass-in-mmap-function)