Vulnerability · Published May 21, 2026 · Assigned by freebsd

CVE-2026-45253Missing validation in ptrace(PT_SC_REMOTE)

High 8.4

In plain English

A high-severity out-of-bounds write in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.0-RELEASE – before p914.4-RELEASE – before p514.3-RELEASE – before p14

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:21.ptrace.asc vendor-advisory