Vulnerability · Published Jun 27, 2026 · Assigned by freebsd

CVE-2026-49416Integer overflow in vt(4) CONS_HISTORY ioctl

High 7.8

In plain English

A high-severity integer overflow in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 95.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.0-RELEASE – before p1014.4-RELEASE – before p614.3-RELEASE – before p15

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:34.vt.asc vendor-advisory