CVE-2026-39461 Details
Description
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.
A vulnerability in libcasper, a FreeBSD library that allows Capsicum-sandboxed applications to access restricted system interfaces, has been identified. The issue arises because libcasper does not properly validate socket descriptors before using the select system call to monitor data availability. This oversight can lead to stack corruption, particularly if an application allocates large file descriptors by leaving many open and then executing a program that fails to close them. The vulnerability is especially concerning if the affected application has setuid root privileges, as it could be exploited to escalate local privileges.
Users can upgrade to a supported FreeBSD version that has addressed this vulnerability. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:22.libcasper.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 14.3 - 14.3 p1 14.3 p10 14.3 p11 14.3 p12 14.3 p13 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 p1 14.4 p2 14.4 p3 14.4 p4 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 15.0 p5 15.0 p6 15.0 p7 15.0 p8 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | [email protected] |