CVE-2026-45258 Details
Description
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memory. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).
A vulnerability in the FreeBSD sound driver allows unprivileged local users to read and write kernel memory, potentially leading to privilege escalation and full control of the system. This issue arises from the sound driver's mmap support, where the addition of user-supplied offset and length could overflow, bypassing buffer size checks. The flawed validation allowed mappings to extend beyond audio buffers into unrelated kernel memory. The vulnerability affects all supported FreeBSD versions, with the /dev/dsp device nodes being world-accessible by default.
Users can upgrade to a supported FreeBSD stable or release/security branch dated after the correction date. Instructions for updating via pkg, freebsd-update, or applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-681 | Incorrect Conversion between Numeric Types | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 14.3 - 14.3 p1 14.3 p10 14.3 p11 14.3 p12 14.3 p13 14.3 p14 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 p1 14.4 p2 14.4 p3 14.4 p4 14.4 p5 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 15.0 p5 15.0 p6 15.0 p7 15.0 p8 15.0 p9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 27, 2026 | New CVE Received | [email protected] |