PT-2026-36008 · Libnv+1 · Libnv+1

Joshua Rogers · Published 2026-04-29 · Updated 2026-04-30 · CVE-2026-39457

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libnv (affected versions not specified)

Description When exchanging data over a socket, the software uses the select() function to wait for data. It fails to verify if the provided socket descriptor exceeds the file descriptor set size limit of FD SETSIZE (1024). An attacker capable of forcing the application to allocate large file descriptors can trigger stack corruption. If the target application is setuid-root, this may lead to local privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-39457

Affected Products

Freebsd

Libnv

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-39457 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc · Vendor Advisory
• https://reddit.com/r/freebsd/comments/1sz8nr3/20260429_brings_six_new_security_advisories_three · Reddit Post
• https://freebsd.org/security/advisories/FreeBSD-SA-26:16.libnv.asc · Note
• https://twitter.com/vuldb/status/2049796695438110899 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049795575965434130 · Twitter Post
• https://t.me/CVEtracker/52298 · Telegram Post