Stack buffer overflow via setcred(2)

CVE	CVE-2026-45250
State	PUBLISHED
Assigner	freebsd
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-05-21 09:16:30 UTC
Updated	2026-05-22 08:16:14 UTC
Description	The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.

Primary CVSS: v3.1 7.8 HIGH from ADP

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.000060000 probability, percentile 0.003810000 (date 2026-05-27)

Problem Types: CWE-121 | CWE-121 CWE-121: Stack-based Buffer Overflow

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Freebsd	Freebsd	14.3	-	All	All
Operating System	Freebsd	Freebsd	14.3	p1	All	All
Operating System	Freebsd	Freebsd	14.3	p10	All	All
Operating System	Freebsd	Freebsd	14.3	p11	All	All
Operating System	Freebsd	Freebsd	14.3	p12	All	All
Operating System	Freebsd	Freebsd	14.3	p13	All	All
Operating System	Freebsd	Freebsd	14.3	p2	All	All
Operating System	Freebsd	Freebsd	14.3	p3	All	All
Operating System	Freebsd	Freebsd	14.3	p4	All	All
Operating System	Freebsd	Freebsd	14.3	p5	All	All
Operating System	Freebsd	Freebsd	14.3	p6	All	All
Operating System	Freebsd	Freebsd	14.3	p7	All	All
Operating System	Freebsd	Freebsd	14.3	p8	All	All
Operating System	Freebsd	Freebsd	14.3	p9	All	All
Operating System	Freebsd	Freebsd	14.4	-	All	All
Operating System	Freebsd	Freebsd	14.4	p1	All	All
Operating System	Freebsd	Freebsd	14.4	p2	All	All
Operating System	Freebsd	Freebsd	14.4	p3	All	All
Operating System	Freebsd	Freebsd	14.4	p4	All	All
Operating System	Freebsd	Freebsd	14.4	rc1	All	All
Operating System	Freebsd	Freebsd	15.0	-	All	All
Operating System	Freebsd	Freebsd	15.0	p1	All	All
Operating System	Freebsd	Freebsd	15.0	p2	All	All
Operating System	Freebsd	Freebsd	15.0	p3	All	All
Operating System	Freebsd	Freebsd	15.0	p4	All	All
Operating System	Freebsd	Freebsd	15.0	p5	All	All
Operating System	Freebsd	Freebsd	15.0	p6	All	All
Operating System	Freebsd	Freebsd	15.0	p7	All	All
Operating System	Freebsd	Freebsd	15.0	p8	All	All

Source	Vendor	Product	Version	Platforms
CNA	FreeBSD	FreeBSD	affected 15.0-RELEASE p9 release	Not specified
CNA	FreeBSD	FreeBSD	affected 14.4-RELEASE p5 release	Not specified
CNA	FreeBSD	FreeBSD	affected 14.3-RELEASE p14 release	Not specified

Reference	Source	Link	Tags
www.openwall.com/lists/oss-security/2026/05/21/18	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
www.openwall.com/lists/oss-security/2026/05/22/5	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
security.freebsd.org/advisories/FreeBSD-SA-26:18.setcred.asc	[email protected]	security.freebsd.org	Vendor Advisory
www.openwall.com/lists/oss-security/2026/05/21/3	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Ryan of Calif.io (en)

CNA: Przemyslaw Frasunek (en)

There are currently no legacy QID mappings associated with this CVE.