CVE-2026-39457

Estado: AnalizadaAlta (7.8)—

When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024).

An attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption. If the target application is setuid-root, then this could be used to elevate local privileges.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution75 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access70 %

Vulnerabilidad local (AV:L, PR:L) que corrompe la pila mediante file descriptors malformados en libnv, permitiendo escalada de privilegios en aplicaciones setuid-root. El desbordamiento de búfer (CWE-121) habilita ejecución de código con privilegios elevados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Execution Prevention Application Developer Guidance Active Directory Configuration User Training User Account Management

Tecnologías afectadas (1)

Freebsd — Freebsd

CWE

CWE-121

Referencias

https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-39457",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39457",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-30T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "libnv"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "15.0-RELEASE",
              "lessThan": "p7",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.4-RELEASE",
              "lessThan": "p3",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.3-RELEASE",
              "lessThan": "p12",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "13.5-RELEASE",
              "lessThan": "p13",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-04-30T09:16:03.270",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When exchanging data over a socket, libnv uses select(2) to wait for data to arrive.  However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024).\n\nAn attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption.  If the target application is setuid-root, then this could be used to elevate local privileges."
    }
  ],
  "lastModified": "2026-06-17T10:42:07.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4216D505-95A5-4FCC-8B9A-26FCD32B0445"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C859EE2-59C0-4234-BFF0-7794AC4956DD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1CEB391-5FA3-4FFD-9279-113093DD500D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE54A637-BD2A-42F2-A155-CF3D4292B32D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}