Dashboard / CVE-2026-58088

CVE-2026-58088

HIGH
MEDIUM Priority: 0.01 BB Relevance: 40/100
Published: 2026-08-19 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: High
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer. An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.

Weakness Classification (2)

Affected Software (25)

VendorProductVersion
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.1
freebsd freebsd 15.1
freebsd freebsd 15.1
freebsd freebsd 15.1

References & Advisories (1)

Bug Bounty Relevance

40 / 100
✓ No authentication
✓ No user interaction

CVSS Score

7.4 / 10.0 v3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.10%
Raw Score 0.001050
Percentile 1.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00105
2026-10-28
0.00105

Intelligence Sources

nvd ref →

External Links