What’s Vulnerable › Vulnerabilities
CVE-2026-49414: ASLR bypass for setuid executables via procctl(2)
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-27 · updated 2026-07-01
- Weakness: CWE-179
Description
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.
Affected products
- FreeBSD: 14.3, 14.3-p1, 14.3-p10, 14.3-p11, 14.3-p12, 14.3-p13 (+25)
References
Get alerted when CVE-2026-49414 or the next vulnerability affects your stack