CVE-2026-58087 Heap out-of-bounds access in semctl(2)
A local attacker can exploit a sequence number wrap in semctl to cause heap out-of-bounds access, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-58087?
CVE-2026-58087 is a high-severity vulnerability in Freebsd Freebsd, published on 19 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.
An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.
Which versions are affected by CVE-2026-58087?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-58087?
No fix has been published for CVE-2026-58087 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58087 being exploited?
There is no known exploitation of CVE-2026-58087 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-v78v-rxq5-6w38.