OpenBSD vulnerabilities

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.

In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().

A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.

CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.

Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.

The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.