Read the docs
TI-2026-04142 Aliases CVE-2026-4747GHSA-h63x-7924-m7qf

Remote code execution via RPCSEC_GSS packet validation

Priority HIGH 73CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03431 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed FreeBSD (FreeBSD): p5, p1, p10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeBSDFreeBSD15.0-RELEASE to before p5; 14.4-RELEASE to before p1; 14.3-RELEASE to before p10; 13.5-RELEASE to before p11p5, p1, p10, p11Patch availableCNA
  • FreeBSD VendorFreeBSD Affected 15.0-RELEASE to before p5; 14.4-RELEASE to before p1; 14.3-RELEASE to before p10; 13.5-RELEASE to before p11 Fixed in p5, p1, p10, p11 Patch available CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*13.5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*13.5 beta3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*13.5 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*13.5 p10VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*13.5 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*13.5 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*13.5 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*13.5 p5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*13.5 p6VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*13.5 p7VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:* Versions 13.5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:* Versions 13.5 beta3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:* Versions 13.5 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:* Versions 13.5 p10 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:* Versions 13.5 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:* Versions 13.5 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:* Versions 13.5 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:* Versions 13.5 p5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:* Versions 13.5 p6 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:* Versions 13.5 p7 Vulnerable ·FreeBSD
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*13.5 p8VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*13.5 p9VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*14.3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*14.3 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*14.3 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*14.3 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*14.3 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*14.3 p5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*14.3 p6VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*14.3 p7VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*14.3 p8VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*14.3 p9VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*14.4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*14.4 rc1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*15.0VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*15.0 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*15.0 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*15.0 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*15.0 p4VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:* Versions 13.5 p8 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:* Versions 13.5 p9 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* Versions 14.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* Versions 14.3 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* Versions 14.3 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* Versions 14.3 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* Versions 14.3 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* Versions 14.3 p5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* Versions 14.3 p6 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* Versions 14.3 p7 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* Versions 14.3 p8 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* Versions 14.3 p9 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* Versions 14.4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* Versions 14.4 rc1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* Versions 15.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* Versions 15.0 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* Versions 15.0 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* Versions 15.0 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* Versions 15.0 p4 Vulnerable ·FreeBSD

Remediation

  • Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p1, p10, p11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4747
  2. 2026-10-03 Alias added: GHSA-h63x-7924-m7qf

References

Exploit 2

Advisory 1

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
See all 576 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences