[NEW] [medium] FreeBSD Project FreeBSD OS: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to escalate privileges, disclose information, manipulate files, conduct a denial of service attack, and execute arbitrary code.

Who is affected

Users of FreeBSD OS.

Urgency

Remediation is urgent due to the high severity of the vulnerabilities and potential for exploitation.

Action

Update to the latest version of FreeBSD OS.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

medium

Published

2026-08-20

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2165

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-494150.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494180.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494190.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494200.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494210.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494220.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494230.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494240.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494250.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-494260.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownCVE-2026-58082: The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediat…nvd
• unknownCVE-2026-58081: Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size o…nvd
• unknownCVE-2026-49425: The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit …nvd
• unknownCVE-2026-49424: The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared …nvd
• unknownCVE-2026-49423: When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() in…nvd
• unknownCVE-2026-49431: The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such th…nvd
• unknownCVE-2026-49430: The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload siz…nvd
• highCVE-2026-49429: The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer s…nvd
• highCVE-2026-49428: Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrec…nvd
• highCVE-2026-49427: Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2)…nvd
• unknownCVE-2026-49426: When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return va…nvd
• highCVE-2026-49422: The RACK setsockopt(2) handler drops the connection lock in order to copy option data from use…nvd

Recent advisories for FreeBSD Project FreeBSD OS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund · 2026-08-20
• high[UPDATE] [high] FreeBSD Project FreeBSD OS: Multiple Vulnerabilitiescert-bund · 2026-08-13

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25