CVE-2026-49416

Summary

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation.

An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.

Affected Software

VendorProductVersion RangeStatus
FreeBSDFreeBSD15.0-RELEASE < p10affected
FreeBSDFreeBSD14.4-RELEASE < p6affected
FreeBSDFreeBSD14.3-RELEASE < p15affected

Weaknesses

  • CWE-190: CWE-190: Integer Overflow or Wraparound

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References