PT-2026-36012 · Freebsd · Freebsd

Ryan Austin · Published 2026-04-29 · Updated 2026-06-16 · CVE-2026-7270

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 15.0-RELEASE-p7 FreeBSD versions prior to 14.4-RELEASE-p3 FreeBSD versions prior to 14.3-RELEASE-p12 FreeBSD versions prior to 13.5-RELEASE-p13 FreeBSD versions from 2013 through 13.4.x

Description An operator precedence bug in the kernel within the exec args adjust args() function leads to a buffer overflow. This allows attacker-controlled data to overwrite adjacent execve(2) argument buffers. An unprivileged user can exploit this issue to execute code with kernel privileges and obtain superuser (root) access to the system.

Recommendations Update to version 15.0-RELEASE-p7. Update to version 14.4-RELEASE-p3. Update to version 14.3-RELEASE-p12. Update to version 13.5-RELEASE-p13. Apply the available patch for versions older than the listed releases.

Exploit

Fix

LPE

Weakness Enumeration

CWE-783

Related Identifiers

BDU:2026-06463

CVE-2026-7270

Affected Products

Freebsd

References · 25

• 🔥 https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 · Exploit
• 🔥 https://github.com/babyshen/freebsd-CVE-2026-7270 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7270 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/731934 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-26:13.exec.asc · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06463 · Security Note
• https://t.me/opennews/15094 · Telegram Post
• https://twitter.com/luckyhacker43/status/2066232831836102763 · Twitter Post
• https://twitter.com/N45HTOfficial/status/2060898935489822992 · Twitter Post
• https://freebsd.org/security/advisories/FreeBSD-SA-26:13.exec.asc · Note
• https://t.me/CVEtracker/52294 · Telegram Post
• https://t.me/opennews/15080 · Telegram Post
• https://twitter.com/csalab_id/status/2053725041037328458 · Twitter Post
• https://twitter.com/calif_io/status/2052464372308660427 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049821172385054956 · Twitter Post