Loading story…
FreeBSD released security updates for 22 vulnerabilities across the operating system, including multiple flaws that could lead to remote code execution, local privilege escalation to root, denial of service, memory corruption, and information disclosure. The most severe issue, CVE-2026-49420, affects libalias, where improper handling of RTSP traffic during NAT processing can allow remote code execution as root on systems using ipfw NAT or natd.
The fixes were shipped in FreeBSD 15.1-RELEASE-p1, 15.0-RELEASE-p11, 14.4-RELEASE-p7, and 14.3-RELEASE-p16. Additional patched components include execve, Jail, OpenZFS, Linuxulator, KTLS, sound, vt, ptrace, IPv6 multicast filtering, tcp_rack, compat32, iconv, and pathname resolution protections such as AT_RESOLVE_BENEATH, with the advisory noting that 13 of the issues could enable privilege escalation to root.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Fixes for the disclosed vulnerabilities were released in FreeBSD 15.1-RELEASE-p1, 15.0-RELEASE-p11, 14.4-RELEASE-p7, and 14.3-RELEASE-p16. The patched issues affected components including execve, Jail, OpenZFS, Linuxulator, KTLS, sound, vt, ptrace, IPv6 multicast filtering, tcp_rack, compat32, iconv, and pathname resolution protections.
FreeBSD published a security advisory covering 22 vulnerabilities, including issues that could lead to remote code execution, local privilege escalation, denial of service, memory corruption, and information disclosure. The most serious issue highlighted was CVE-2026-49420 in libalias, involving unsafe RTSP handling in NAT-related functionality that could allow remote code execution as root via ipfw NAT or natd.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OPNsense released version **26.7** for its FreeBSD-based firewall and routing platform, updating major components including a FreeBSD 15.1 development snapshot, **OpenVPN 2.7**, **PHP 8.5**, and **Python 3.13**, alongside IPv6, KEA DHCP, Captive Portal, and outbound NAT changes. The release is notable for patching a critical vulnerability tracked as **`CVE-2026-57155`** and rated **9.9/10**. The flaw affected the GeoIP alias import path exposed through the Web API, where insufficient validation of GeoIP-related file paths or URLs allowed an authenticated administrator to create arbitrary files as **root** and reach shell command execution paths. Reports said the issue could be abused with directory traversal to write files such as `../../../../../../../../etc/newsyslog.conf.d/zzz_pwn`, ultimately enabling **root-level remote code execution** on affected systems.
Jul 16, 2026
The FreeBSD Project issued security advisory **FreeBSD-SA-26:10.tty** for **CVE-2026-5398**, a kernel use-after-free flaw in the `TIOCNOTTY` handler that affects all supported FreeBSD versions. The vulnerability occurs because `TIOCNOTTY` does not clear a back-pointer from the controlling terminal structure to the calling process session, leaving a dangling pointer after the process exits. FreeBSD warned that a malicious unprivileged local process could exploit the bug to gain **root privileges**. The project released fixes across supported stable and release branches on 2026-04-21, said **no workaround is available**, and directed administrators to apply the updates and reboot affected systems.
Jun 29, 2026
The FreeBSD Project disclosed **CVE-2026-42511**, a critical vulnerability in the default IPv4 DHCP client, `dhclient(8)`, that can allow a local network attacker to execute arbitrary code as **root**. The flaw arises because `dhclient(8)` does not properly escape double quotes in the BOOTP file field before writing data to the DHCP lease file, allowing a malicious DHCP response to inject configuration content that is later re-parsed and executed by `dhclient-script(8)`. Exploitation requires the attacker to be on the same broadcast domain and operate a rogue DHCP server that replies with crafted DHCP data. FreeBSD said the issue affects all currently supported branches, including **FreeBSD 15.0, 14.4, 14.3, and 13.5** release and stable versions, and published patches in security advisory **FreeBSD-SA-26:12.dhclient**. Administrators were urged to update immediately, and FreeBSD noted that switch-level **DHCP snooping** can help mitigate attacks from rogue DHCP servers where continued use of `dhclient` is necessary.
Jun 29, 2026