CVE-2026-32849
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.
Risk Assessment
A local attacker with access to /dev/crypto and a compression session can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled, leading to denial of service (DoS).
Recommendation
Immediately update NetBSD to a version containing commit ec8451e or later. Restrict access to /dev/crypto to trusted users only.
Other vulnerabilities in NetBSD
See all- CVE-2026-57843Medium
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures.
- CVE-2026-57842High
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX.
- CVE-2017-1000374Critical
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
- CVE-2026-32848Medium
NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.
- CVE-1999-0764Medium
NetBSD allows ARP packets to overwrite static ARP entries.
- CVE-1999-0763Medium
NetBSD on multi-homed hosts allows ARP packets from one network to modify ARP entries on another connected network.
- CVE-1999-0422Medium
In some cases, mount in NetBSD 1.3.3 allows local users to execute programs in file systems that have the 'noexec' flag set.
Original NVD description (English source)
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled and corrupted UIO pointer arithmetic.