CVE-2026-4747 Details
Description
Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.
A remote code execution vulnerability has been identified in the RPCSEC_GSS implementation of FreeBSD. This issue arises because the packet validation routine does not properly validate the size of data being copied into a stack buffer, allowing a malicious client to exploit this oversight and trigger a stack overflow. The vulnerability exists in the kernel when the kgssapi.ko module is loaded, and can be exploited by an authenticated user who sends packets to the NFS server. Additionally, in userspace, applications running an RPC server with the librpcgss_sec library loaded are also vulnerable to remote code execution from any client that can send packets to them.
Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/exploit.py | CISA-ADP | Exploit |
| https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747 | CVE | ExploitThird Party Advisory |
| https://security.freebsd.org/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 13.5 - 13.5 beta3 13.5 p1 13.5 p10 13.5 p2 13.5 p3 13.5 p4 13.5 p5 13.5 p6 13.5 p7 13.5 p8 13.5 p9 14.3 - 14.3 p1 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CVE |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |