CVE-2025-14769 Details
Description
In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference. Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would allow the traffic to pass.
A denial-of-service vulnerability has been identified in the IPFW firewall component of FreeBSD versions 13 and 14. The issue arises when the 'tcp-setmss' directive is used. In such cases, the 'tcp-setmss' handler may inadvertently free the packet data and generate an error without stopping the rule processing. This oversight can allow a subsequent rule to permit the traffic, even after the packet data has been cleared, leading to a NULL pointer dereference. As a result, maliciously crafted packets from a remote host can exploit this flaw, causing a denial-of-service condition.
Users can upgrade to a supported FreeBSD stable or release/security branch dated after the correction date. Instructions for updating via the FreeBSD Update utility or applying a source code patch are available in the FreeBSD security advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-25:11.ipfw.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 13.5 - 13.5 p1 13.5 p2 13.5 p3 13.5 p4 13.5 p5 13.5 p6 13.5 p7 14.3 - 14.3 p1 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 9, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | New CVE Received | [email protected] |