Loading vulnerability…
CVE-2026-45250 is a kernel stack buffer overflow in FreeBSD 14.x affecting the setcred(2) system call. The flaw is in kern_setcred_copyin_supp_groups(), where a size calculation uses the size of a pointer rather than the size of a gid_t element when copying a user-supplied supplementary groups list into a fixed-size kernel stack buffer. On LP64 systems this results in an 8-byte stride being used for data intended to be copied as 4-byte gid_t entries, causing an attacker-controlled overwrite of stack memory. The vulnerable copy occurs before the caller's privilege level is validated, so the bug is reachable by an unprivileged local user even though setcred(2) is intended for privileged callers. Public analysis indicates the overflow occurs in the user_setcred call path and can corrupt saved state on the kernel stack, enabling control-flow manipulation and eventual execution in kernel context. The issue was introduced in FreeBSD 14.x; FreeBSD 14.4 and stable/14 were reported vulnerable, while the same source bug was noted in 15.0 but described as practically yielding panic or denial of service rather than a confirmed working privilege-escalation path. FreeBSD 13.x and earlier are not affected because setcred(2) is absent there.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains research artifacts and working exploit code for a FreeBSD 14.x kernel stack buffer overflow in setcred(2), specifically the sizeof(*groups) bug in kern_setcred_copyin_supp_groups(). Structure is small and focused: top-level documentation (README.md, setcred.txt), a curated exploits/ directory with three C programs, a helper wrapper, a Makefile, and exploit-specific documentation. Main capabilities: - exploits/poc_dos.c: minimal local DoS proof-of-concept. Any unprivileged user can trigger the vulnerable setcred(2) path with sc_supp_groups_nb=15 and attacker-controlled data, potentially panicking the kernel. - exploits/exp2_lpe_no_smap.c: local privilege escalation for FreeBSD 14.4 on kernels without SMAP/SMEP. It mmaps a fixed RWX user page at 0x100000000, builds fake kernel-like objects (thread/proc/ucred/sysentvec), corrupts saved r12 via the stack overflow, and redirects the amd64_syscall indirect call to user-space shellcode. The shellcode zeroes UID/GID-related fields in the current thread credentials and then execs /bin/sh if uid becomes 0. - exploits/exp_setcred_smap_zfs.c: more advanced SMAP/SMEP-safe local privilege escalation. It resolves ZSTD_initCStream_advanced from zfs.ko and prison0 via kldsym(2), uses sysctl KERN_PROC_ARGS to place a forged ucred in the parent process's kernel-backed pargs slab and a pointer value (K1) in the child’s pargs slab, then triggers the same setcred overflow to corrupt r12. The hijacked amd64_syscall indirect call lands in the zfs gadget, which writes td_ucred to the forged credential in kernel heap memory. After privilege gain, it chowns/chmods /tmp/rsh to root:04755. - exploits/wrapper.c: simple setuid-root launcher that calls setgid(0), setuid(0), and execs /bin/sh. This is persistence/post-exploitation support for the SMAP/SMEP-safe path. - exploits/Makefile.setcred_smap_zfs: build/install helper for exp_setcred_smap_zfs and wrapper. Targeting and purpose: - Targets FreeBSD 14.4-RELEASE amd64 GENERIC and stable/14; documentation notes FreeBSD 15.0 remains vulnerable to the bug but only demonstrated as DoS, not working LPE. - Attack vector is strictly local; there are no remote network callbacks, C2 endpoints, or external URLs in the code. - The exploit’s purpose is to demonstrate practical impact of the setcred(2) bug, ranging from kernel panic to full root compromise. Notable fingerprintable artifacts are local file paths (/tmp/rsh, /bin/sh), kernel symbols (ZSTD_initCStream_advanced, prison0), the zfs.ko dependency, sysctl MIBs used for process args/info, and the SYS_setcred trigger path. Overall, this is a real, operational local kernel exploit repository rather than a detector or framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local privilege escalation vulnerability in FreeBSD's setcred handling caused by a sizeof confusion that leads to a stack overflow and local root shell.
A local privilege escalation vulnerability in FreeBSD's setcred handling caused by a sizeof confusion leading to a stack overflow and local root shell.
A vulnerability referred to as 'setcred'; the discussion states FreeBSD 11 is not affected because the syscall does not exist there.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.