Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-49414

ASLR bypass for setuid executables via procctl(2)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p10affected
  • 14.4-RELEASE to < p6affected
  • 14.3-RELEASE to < p15affected

References