CVE-2026-49420: Freebsd

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).

Affected products

• Freebsd Freebsd: version 14.3 only; version 14.4 only; version 15.0 only; version 15.1 only

Published 2026-08-19. Last modified 2026-09-01.