Loading vulnerability…
CVE-2026-45258 is a local kernel memory corruption and disclosure vulnerability in FreeBSD's sound(4) mmap path, specifically in dsp_mmap_single(). The function validated a user-requested mapping by checking the sum of a user-controlled offset and length against the backing audio buffer size. Because this addition could overflow, a sufficiently large offset and length could wrap around and incorrectly satisfy the bounds check. The offset was then narrowed from 64 bits to 32 bits during conversion to a buffer address, producing a mapping that extended beyond the intended audio buffer into unrelated kernel memory. As a result, a local user able to access /dev/dsp could obtain an mmap region referencing kernel memory outside the audio buffer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single standalone C local privilege-escalation exploit in exp.c. It is not part of a larger framework. The exploit targets a FreeBSD kernel/device-driver condition involving /dev/dsp. Its overall flow is: raise resource limits, query the kernel base address via kldstat(1), compute a hardcoded target kernel function address using PRIV_CHECK_CRED_OFF (0x950af0), spray many /dev/dsp file descriptors and shared mappings, inspect the current process VM map via sysctl(KERN_PROC_VMMAP) to recover the kernel virtual offset associated with its DSP mapping, and then craft a large mmap with a negative file offset to create a user mapping that aliases or reaches the chosen kernel page. It then writes an 8-byte patch (xor eax,eax; ret; NOPs) into the target kernel code, effectively forcing a credential/privilege check routine to succeed. After patching, the exploit calls setgid(0) and setuid(0), verifies UID/EUID 0, and execs /bin/sh to yield a root shell. The code is operational but brittle: it depends on a specific kernel layout/offset and local access to the vulnerable device node. No network activity is present; the attack vector is purely local.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A FreeBSD sound subsystem mmap vulnerability that can leak kernel memory to users able to access /dev/dsp.
An information disclosure vulnerability in FreeBSD sound subsystem mmap handling that can leak kernel memory via /dev/dsp access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.