Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-49416

Integer overflow in vt(4) CONS_HISTORY ioctl

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p10affected
  • 14.4-RELEASE to < p6affected
  • 14.3-RELEASE to < p15affected

References