CVE-2026-45252 Details
Description
When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated. If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space.
A heap overflow vulnerability has been identified in the FreeBSD fusefs file system when it manages extended attributes. The issue arises because the kernel sends a FUSE_LISTXATTR message to the userspace daemon to fetch the list of extended attributes for a file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. However, the fusefs kernel module does not verify that the entire list is properly NUL-terminated before using it. This oversight can be exploited by a malicious daemon that sends a non-NUL-terminated list, leading the kernel module to read beyond the end of a heap-allocated buffer and potentially write beyond the end of another buffer. As a result, the malicious daemon could either disclose up to 253 bytes of kernel heap memory or inject up to 250 bytes of attacker-controlled data into unallocated kernel heap space.
Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date. For systems running FreeBSD 15.0-RELEASE on amd64 or arm64, the update can be performed using the pkg utility. For FreeBSD 14.4 or 14.3, the update can be applied via the freebsd-update utility. Instructions for applying the update via a source code patch are also available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:20.fusefs.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 14.3 - 14.3 p1 14.3 p10 14.3 p11 14.3 p12 14.3 p13 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 p1 14.4 p2 14.4 p3 14.4 p4 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 15.0 p5 15.0 p6 15.0 p7 15.0 p8 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | [email protected] |