CVE-2026-49420 Buffer overflow in libalias RTSP handler
A buffer overflow in FreeBSD's libalias RTSP handler allows remote code execution in the kernel or natd process via crafted traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49420?
CVE-2026-49420 is a high-severity memory corruption vulnerability in Freebsd Freebsd, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet.
A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).
Weakness: CWE-121
Which versions are affected by CVE-2026-49420?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-49420?
No fix has been published for CVE-2026-49420 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-49420 being exploited?
There is no known exploitation of CVE-2026-49420 in the wild and no public exploit code.