CVE-2026-45259
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in the sigqueue(2) implementation in FreeBSD allows a process in capability mode to send signals to any process, bypassing Capsicum sandbox restrictions. The missing check for the target PID being the calling process's own enables an attacker to interfere with other processes.
Risk Assessment
The risk is that a compromised sandboxed process can send signals like SIGKILL or SIGSTOP to other processes of the same user or, if running as superuser, to any process in the system. This could disrupt critical services or facilitate further attacks.
Recommendation
Immediately update FreeBSD to a version containing the fix for CVE-2026-45259. If an update is not possible, consider temporarily disabling sigqueue(2) in capability mode or applying additional access control mechanisms.
Other vulnerabilities in FreeBSD
See all- CVE-2017-1087High
In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, allowing processes in one jail to read and modify the content of POSIX shared memory objects created by processes in another jail or the host system.
- CVE-2016-1882High
FreeBSD versions 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.
- CVE-2015-1414High
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10, 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
- CVE-2026-49419High
Vulnerability in FreeBSD's kern_jail_set() and kern_jail_get() when the JAIL_AT_DESC flag is used. Double release of the caller's current prison reference can lead to a reference count underflow and use-after-free.
- CVE-2026-49418High
Vulnerability in FreeBSD kernel when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object. Physical pages are marked invalid but remain in the pager's list, leading to a double free on object destruction.
- CVE-2026-49415High
Vulnerability in FreeBSD during execve(2) of SUID binaries. The new virtual address space is installed before credentials are updated, allowing another process of the same user to access memory via procfs or linprocfs.
- CVE-2026-45255High
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.
- CVE-1999-0963High
The mount_union command in FreeBSD allows local users to gain root privileges via a symlink attack.
- CVE-1999-0052High
CVE-1999-0052 concerns IP fragmentation in FreeBSD that can lead to system crashes. A remote attacker can exploit this vulnerability to cause unexpected system downtime.
- CVE-1999-0053Medium
CVE-1999-0053 is a denial of service (DoS) vulnerability in FreeBSD that exploits TCP RST packets. An attacker can remotely initiate a connection reset, leading to service disruption.
Original NVD description (English source)
sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue(2) to send signals to any process it could signal following standard Unix permissions, bypassing the Capsicum sandbox restriction. A compromised sandboxed process could interfere with other processes, for example by sending SIGKILL or SIGSTOP. This could be any process running as the same user, or any process, for a superuser sandboxed process.