Vulnerability · Published Mar 9, 2026 · Assigned by freebsd

CVE-2025-14769ipfw denial of service

High 7.5

In plain English

A high-severity null pointer dereference in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.2%top 30.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference. Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would allow the traffic to pass.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	14.3-RELEASE – before p713.5-RELEASE – before p8

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-25:11.ipfw.asc vendor-advisory