{"api_version":"1","generated_at":"2026-08-19T11:45:16+00:00","cve":"CVE-2026-58088","urls":{"html":"https://cve.report/CVE-2026-58088","api":"https://cve.report/api/cve/CVE-2026-58088.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-58088","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-58088"},"summary":{"title":"Race condition in ELF core dump segment counting","description":"The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them.  A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer.\n\nAn unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.","state":"PUBLISHED","assigner":"freebsd","published_at":"2026-08-19 08:17:12","updated_at":"2026-08-19 08:17:12"},"problem_types":["CWE-362","CWE-787","CWE-362 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":[],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:55.elf.asc","name":"https://security.freebsd.org/advisories/FreeBSD-SA-26:55.elf.asc","refsource":"secteam@freebsd.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58088","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58088","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.1-RELEASE p2 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.0-RELEASE p12 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 14.4-RELEASE p8 release","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Maik Muench of Secfault Security","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","modules":["elf"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p2","status":"affected","version":"15.1-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p8","status":"affected","version":"14.4-RELEASE","versionType":"release"}]}],"credits":[{"lang":"en","type":"finder","value":"Maik Muench of Secfault Security"}],"datePublic":"2026-07-29T22:40:00.000Z","descriptions":[{"lang":"en","value":"The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them.  A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer.\n\nAn unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","description":"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","lang":"en","type":"CWE"},{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T07:52:13.411Z","orgId":"63664ac6-956c-4cba-a5d0-f46076e16109","shortName":"freebsd"},"references":[{"tags":["vendor-advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:55.elf.asc"}],"title":"Race condition in ELF core dump segment counting","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"63664ac6-956c-4cba-a5d0-f46076e16109","assignerShortName":"freebsd","cveId":"CVE-2026-58088","datePublished":"2026-08-19T07:52:13.411Z","dateReserved":"2026-06-29T01:40:17.498Z","dateUpdated":"2026-08-19T07:52:13.411Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 08:17:12","lastModifiedDate":"2026-08-19 08:17:12","problem_types":["CWE-362","CWE-787","CWE-362 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"58088","Ordinal":"1","Title":"Race condition in ELF core dump segment counting","CVE":"CVE-2026-58088","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"58088","Ordinal":"1","NoteData":"The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them.  A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer.\n\nAn unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.","Type":"Description","Title":"Race condition in ELF core dump segment counting"}]}}}