CVE-2026-5398

Estado: AnalizadaAlta (8.4)—

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory.

A malicious process can abuse the dangling pointer to grant itself root privileges.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.18%
Percentil entre todas las CVEs puntuadas: 6
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution80 %

Acceso local sin interacción (AV:L/PR:N/UI:N) que explotación use-after-free para escalada de privilegios; consecución de ejecución de código como root.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

Freebsd — Freebsd

CWE

CWE-416

Referencias

https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-5398",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-5398",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-22T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "tty"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "15.0-RELEASE",
              "lessThan": "p6",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.4-RELEASE",
              "lessThan": "p2",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.3-RELEASE",
              "lessThan": "p11",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "13.5-RELEASE",
              "lessThan": "p12",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-04-22T03:16:01.213",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session.  If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory.\n\nA malicious process can abuse the dangling pointer to grant itself root privileges."
    }
  ],
  "lastModified": "2026-06-17T10:58:57.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4216D505-95A5-4FCC-8B9A-26FCD32B0445"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C859EE2-59C0-4234-BFF0-7794AC4956DD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1CEB391-5FA3-4FFD-9279-113093DD500D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}