Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-22 | 2 | Patch2 |
| 2026-05-31 | 1 | Patch1 |
The FreeBSD project released a number of security advisories yesterday. We're still reviewing them. So far, one does not impact MidnightBSD (setcred), and two more do: CVE-2026-39461 (libcasper) and CVE-2026-45254. We've patched the latter in git on master and stable/4.0
Post summary
FreeBSD posts advisories, confirms patching of CVE-2026-45254 in git master and stable/4.0 branches.
🚨 HIGH severity CVE-2026-39461 (CVSS 8.8) affects libcasper(3) in FreeBSD. Stack corruption flaw allows local privilege escalation to root via file descriptor manipulation. Patch immediately if running setuid root apps. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/TBKpV3svZN
Post summary
The tweet announces CVE‑2026‑39461, a stack‑corruption flaw in libcasper(3) on FreeBSD that permits local privilege escalation to root via file descriptor manipulation. It urges patching immediately for systems running setuid root applications.
🚨 HIGH Severity: CVE-2026-39461 (CVSS 8.8) FreeBSD libcasper(3) stack corruption flaw enables local privilege escalation to root. Affects setuid applications using libcasper via FD_SETSIZE overflow. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/pQ0ntNcHDm
Post summary
The tweet announces a high-severity stack corruption vulnerability (CVE-2026-39461) in FreeBSD libcasper that allows local privilege escalation, urging users to apply a patch immediately.
29 of 29 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.3 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 14.4 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |
| OS | freebsd | freebsd | 15.0 | - | - |