CVE-2026-45250

Status: ModifiedHigh (7.8)—

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs.

Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.19%
Percentile among all scored CVEs: 8
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation95 %
Primary impactT1059 Command and Scripting Interpreterexecution90 %

Buffer overflow en syscall setcred(2) accesible localmente por usuario sin privilegios (AV:L, PR:L, UI:N). CWE-121 (stack buffer overflow) permite ejecución de código en contexto kernel. La explotación es T1068 (escalada local), el impacto es T1059 (ejecución arbitraria de código).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Affected technologies (1)

Freebsd — Freebsd

CWEs

CWE-121

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-45250",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45250",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-21T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "setcred"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "15.0-RELEASE",
              "lessThan": "p9",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.4-RELEASE",
              "lessThan": "p5",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.3-RELEASE",
              "lessThan": "p14",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-05-21T09:16:30.010",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:18.setcred.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/21/18",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/21/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/22/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The setcred(2) system call is only available to privileged users.  However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length.  If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs.\n\nBecause the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege.  Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system."
    },
    {
      "lang": "es",
      "value": "La llamada al sistema setcred(2) solo está disponible para usuarios privilegiados. Sin embargo, antes de que se compruebe el nivel de privilegio del llamador, la lista de grupos suplementarios proporcionada por el usuario se copia en un búfer de pila del kernel de tamaño fijo sin validar primero su longitud. Si la lista proporcionada excede la capacidad de ese búfer, ocurre un desbordamiento de búfer de pila.\n\nDebido a que la comprobación de límites en la lista de grupos suplementarios ocurre después de que el búfer de pila del kernel ya ha sido escrito, un usuario local no privilegiado puede desencadenar el desbordamiento sin poseer ningún privilegio especial. La explotación exitosa puede permitir a un atacante ejecutar código arbitrario en el contexto del kernel, permitiendo a un usuario local no privilegiado obtener privilegios elevados en el sistema afectado."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}