CVE-2026-45252 Heap overflow in FUSE_LISTXATTR
A malicious FUSE daemon can trigger a heap overflow in the FreeBSD kernel, potentially disclosing memory or executing code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45252?
CVE-2026-45252 is a medium-severity memory corruption vulnerability in Freebsd Freebsd, published on 21 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated.
If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space.
Weakness: CWE-122
Which versions are affected by CVE-2026-45252?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-45252?
No fix has been published for CVE-2026-45252 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-45252 being exploited?
There is no known exploitation of CVE-2026-45252 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-fqrg-fvv5-42g2.