VulnSocial

CVE-2026-49413Disclosure(freebsd / freebsd)

HIGHCVSS 7.1 · HIGH

Exploitation ongoing with high activity in latest observed window (5 mentions)

Immediate actions

  • Prioritize remediation for freebsd freebsd systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-group-ID Linux binary, gaining the privileges of that binary.

freebsd CVEsBack to dashboard
7.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-266

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • freebsd

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • 10 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 3 signals
  • Technical details provided in 10 signals
  • Disclosure: 5 classified signals
  • Peaked at 5 mentions on most recent observed day (2026-07-11)
  • 10 total mentions across 4 days

Affected systems

Vendors
freebsd
Products
freebsd

3 versions affected across 1 product

Deep dive

Activity timeline10 mentions / 4d
01345Mentions · 2026-06-10: 1Mentions · 2026-06-15: 1Mentions · 2026-06-27: 3Mentions · 2026-07-11: 5PoC Mentioned / Linked · 2026-06-10: 1PoC Mentioned / Linked · 2026-06-15: 1PoC Mentioned / Linked · 2026-07-11: 1Exploit Tool / Code · 2026-06-15: 1Exploit Tool / Code · 2026-07-11: 1Active Exploitation · 2026-07-11: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-15: 1Technical Details · 2026-06-27: 3Technical Details · 2026-07-11: 506-1006-1506-2707-11
Signal classification5 categories
Disclosure
550.0%
PoC
220.0%
Exploit
110.0%
Active Exploitation
110.0%
General
110.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-06-101
PoC1
2026-06-151
Exploit1
2026-06-273
Disclosure3
2026-07-115
Active Exploitation1Disclosure2General1PoC1
Full discourse10 posts
  • ii4gsp@ii4gsp
    PoC

    CVE-2026-49413 - FreeBSD LPE via Linuxulator AT_SECURE Logic Bug A setuid exec ordering bug in the Linuxulator emits AT_SECURE=0 in auxv, turning LD_PRELOAD into euid=0 privilege escalation. https://ii4gsp.github.io/cve-2026-49413/

    Post summary

    The post announces the FreeBSD LPE CVE-2026-49413 with technical details and provides a link likely containing a Proof of Concept.

    09031183.0K
    128 followersView on X
  • Daily CyberSecurity@the_yellow_fall
    Exploit

    A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets local users get root. Public PoC exploit code makes patching urgent. #FreeBSD #CVE202649413 #Linuxulator #PrivilegeEscalation #InfoSec https://securityonline.info/freebsd-privilege-escalation-cve-2026-49413 https://t.co/FUnb2YUm7W

    Post summary

    The post announces a privilege‑escapement flaw in FreeBSD’s Linuxulator (CVE‑2026‑49413) that comes with publicly available PoC exploit code, underscoring the urgency of patching.

    1301851.2K
    12.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49413 Local Privilege Escalation via LD_PRELOAD Injection in Fr... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49413 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    The tweet announces CVE‑2026‑49413 as a local privilege escalation via LD_PRELOAD injection, linking to a vulnerability detail page but providing no PoC, exploit code, or patch information.

    00020107
    4.1K followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    07:19 UTC: First exploit attempt in the wild. 0day Intel: A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets loc

    Post summary

    First exploit attempt reported for CVE-2026-49413 in the FreeBSD Linuxulator, indicating active exploitation in the wild.

    1000076
    310 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    04:33 UTC: Thread live on @lyrie_ai. 0day Intel: A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets loc

    Post summary

    A newly reported FreeBSD privilege escalation vulnerability (CVE-2026-49413) targeting the Linuxulator component is announced, with no PoC, exploit, or patch information provided.

    1000061
    310 followersView on X
  • Lyrie.ai@lyrie_ai
    General

    04:22 UTC: Lyrie Sentinel flagged it. 0day Intel: A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets loc

    Post summary

    The post reports a newly identified FreeBSD privilege-escalation flaw (CVE‑2026‑49413) in Linuxulator, but contains no PoC, exploit code, active exploitation, or patch information.

    1000058
    310 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    04:19 UTC: CVE-2026-49413 disclosed. A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets local users get root. Public PoC exploit co

    Post summary

    A privilege‑escalation vulnerability (CVE-2026-49413) in FreeBSD’s Linuxulator was disclosed, and a public PoC exploit is available.

    1000075
    310 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    04:30 UTC: GPT-5 enrichment complete. 60 words. 1 citations. 0day Intel: A FreeBSD privilege escalation flaw (CVE-2026-49413) in the Linuxulator lets loc

    Post summary

    A newly identified 0‑day privilege escalation flaw in the FreeBSD Linuxulator (CVE‑2026‑49413) is disclosed, but no PoC, exploit code, active exploitation evidence, or patch information is provided.

    1000058
    310 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-49413 The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the p… https://www.cve.org/CVERecord?id=CVE-2026-49413 ----- Traducción: CVE-2026-49413 El … http://infoflow.cloud`

    Post summary

    A new CVE, CVE-2026-49413, is announced describing how binaries flagged as setuid/setgid may be incorrectly handled during execve(2), but no PoC, exploit, or mitigation is disclosed.

    0000026
    89 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-49413 The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the p… https://www.cve.org/CVERecord?id=CVE-2026-49413

    Post summary

    The excerpt offers a technical description of CVE‑2026‑49413’s flaw in Linuxulator’s set‑UID/set‑GID detection during execve, without any indication of exploitation, patches, or PoC.

    00000846
    57.7K followersView on X
CPE platform detail31 entries

31 of 31 entries

PartVendorProductVersionTarget SWTarget HW
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--

Explore more

Back to dashboardfreebsd CVEsfreebsd vulnerabilities