PT-2026-42397 · Freebsd · Libcasper+1

Joshua Rogers · CVE-2026-39461 · Published 2026-05-21 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD libcasper(3) (affected versions not specified)

Description libcasper(3) communicates with helper processes via UNIX domain sockets and utilizes the select(2) system call to wait for available data. The software fails to verify if the socket descriptor is within the FD SETSIZE limit of 1024. An attacker can trigger stack corruption by causing an application using libcasper(3) to allocate large file descriptors, such as by opening numerous descriptors and executing a program that does not close them upon startup. If the target application runs with setuid root privileges, this can lead to local privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-39461

Affected Products

Freebsd

Libcasper

References · 10

• https://security.freebsd.org/advisories/FreeBSD-SA-26:22.libcasper.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39461 · Security Note
• https://reddit.com/r/freebsd/comments/1tjaceg/20260520_freebsd_errata_notice_and_seven_security · Reddit Post
• https://t.me/cveNotify/217042 · Telegram Post
• https://t.me/cveNotify/164362 · Telegram Post
• https://twitter.com/midnightbsd/status/2057839142197703048 · Twitter Post
• https://t.me/CVEtracker/54485 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-26:22.libcasper.asc · Note
• https://twitter.com/DFIR_Lab/status/2060915504831672788 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2057642390177845428 · Twitter Post