CVE-2026-49414: Freebsd

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

Affected products

• Freebsd Freebsd: version 14.3 only; version 14.4 only; version 15.0 only

Published 2026-06-27. Last modified 2026-07-01.