CVE-2026-39461: select(2) file descriptor set overflow causes stack overflow
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39461?
The severity of CVE-2026-39461 is rated high with a CVSS score of 8.8.
How does CVE-2026-39461 affect system security?
CVE-2026-39461 allows for a file descriptor set overflow, which can lead to a stack overflow, potentially allowing attackers to execute arbitrary code.
What systems are impacted by CVE-2026-39461?
CVE-2026-39461 affects FreeBSD systems, specifically those utilizing the libcasper library.
How do I mitigate the risks associated with CVE-2026-39461?
To mitigate CVE-2026-39461, users should update to the latest version of FreeBSD that addresses this vulnerability.
What is the vulnerability type of CVE-2026-39461?
CVE-2026-39461 is categorized as a stack overflow vulnerability due to a file descriptor set overflow.