CVE-2026-39461: select(2) file descriptor set overflow causes stack overflow

Published May 21, 2026
·
Updated

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.

Affected Software

30 affected components
FreeBSD libcasper
FreeBSD FreeBSD=14.3
FreeBSD FreeBSD=14.3-p1
FreeBSD FreeBSD=14.3-p10
FreeBSD FreeBSD=14.3-p11
FreeBSD FreeBSD=14.3-p12
FreeBSD FreeBSD=14.3-p13
FreeBSD FreeBSD=14.3-p2
FreeBSD FreeBSD=14.3-p3
FreeBSD FreeBSD=14.3-p4
FreeBSD FreeBSD=14.3-p5
FreeBSD FreeBSD=14.3-p6
FreeBSD FreeBSD=14.3-p7
FreeBSD FreeBSD=14.3-p8
FreeBSD FreeBSD=14.3-p9
FreeBSD FreeBSD=14.4
FreeBSD FreeBSD=14.4-p1
FreeBSD FreeBSD=14.4-p2
FreeBSD FreeBSD=14.4-p3
FreeBSD FreeBSD=14.4-p4
FreeBSD FreeBSD=14.4-rc1
FreeBSD FreeBSD=15.0
FreeBSD FreeBSD=15.0-p1
FreeBSD FreeBSD=15.0-p2
FreeBSD FreeBSD=15.0-p3
FreeBSD FreeBSD=15.0-p4
FreeBSD FreeBSD=15.0-p5
FreeBSD FreeBSD=15.0-p6
FreeBSD FreeBSD=15.0-p7
FreeBSD FreeBSD=15.0-p8

Event History

May 21, 2026
CVE Published
via MITRE·09:20 AM
Data Sourced
via MITRE·09:20 AM
DescriptionWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-39461?

The severity of CVE-2026-39461 is rated high with a CVSS score of 8.8.

2

How does CVE-2026-39461 affect system security?

CVE-2026-39461 allows for a file descriptor set overflow, which can lead to a stack overflow, potentially allowing attackers to execute arbitrary code.

3

What systems are impacted by CVE-2026-39461?

CVE-2026-39461 affects FreeBSD systems, specifically those utilizing the libcasper library.

4

How do I mitigate the risks associated with CVE-2026-39461?

To mitigate CVE-2026-39461, users should update to the latest version of FreeBSD that addresses this vulnerability.

5

What is the vulnerability type of CVE-2026-39461?

CVE-2026-39461 is categorized as a stack overflow vulnerability due to a file descriptor set overflow.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203