CVE-2026-58087

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58087", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-06-29T01:40:17.498Z", "datePublished": "2026-08-19T07:47:50.665Z", "dateUpdated": "2026-08-20T03:55:43.754Z"}, "containers": {"cna": {"datePublic": "2026-07-29T22:40:00.000Z", "title": "Heap out-of-bounds access in semctl(2)", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["sysvsem"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.1-RELEASE", "lessThan": "p2"}, {"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p12"}, {"status": "affected", "versionType": "release", "version": "14.4-RELEASE", "lessThan": "p8"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Maik Muench of Secfault Security"}], "descriptions": [{"lang": "en", "value": "The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.\n\nAn unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-191", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE"}, {"cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read", "lang": "en", "type": "CWE"}, {"cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-19T07:47:50.665Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-58087"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T03:55:43.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-58087", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T11:47:43.787285Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T11:47:55.324Z"}}], "cna": {"title": "Heap out-of-bounds access in semctl(2)", "credits": [{"lang": "en", "type": "finder", "value": "Maik Muench of Secfault Security"}], "affected": [{"vendor": "FreeBSD", "modules": ["sysvsem"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.1-RELEASE", "lessThan": "p2", "versionType": "release"}, {"status": "affected", "version": "15.0-RELEASE", "lessThan": "p12", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p8", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-29T22:40:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.\n\nAn unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)"}, {"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}, {"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-19T07:47:50.665Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58087", "state": "PUBLISHED", "dateUpdated": "2026-08-20T03:55:43.754Z", "dateReserved": "2026-06-29T01:40:17.498Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-08-19T07:47:50.665Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["sysvsem"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p2", "status": "affected", "version": "15.1-RELEASE", "versionType": "release"}, {"lessThan": "p12", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}, {"lessThan": "p8", "status": "affected", "version": "14.4-RELEASE", "versionType": "release"}]}], "source": "secteam@freebsd.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*", "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*", "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*", "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*", "matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*", "matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*", "matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*", "matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:*", "matchCriteriaId": "59EF67B4-E572-483B-BC9E-B2D3D8DF19CE", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*", "matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:*", "matchCriteriaId": "9EC8EE3F-9992-4A0F-A0CD-3B44BA086BD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*", "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*", "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*", "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*", "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*", "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*", "matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*", "matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:*", "matchCriteriaId": "E379873C-DA04-4EAA-ABF6-EB87B4B471A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*", "matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.\n\nAn unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation."}, {"lang": "es", "value": "Los comandos GETALL y SETALL en semctl(2) registraron el n\u00famero de sem\u00e1foros en el conjunto objetivo, liberaron el bloqueo que proteg\u00eda el conjunto, asignaron un b\u00fafer dimensionado para esa cantidad y volvieron a adquirir el bloqueo. Se utiliz\u00f3 una verificaci\u00f3n de n\u00famero de secuencia para verificar que el conjunto no hab\u00eda sido reemplazado en el \u00ednterin, pero el n\u00famero de secuencia se reinicia despu\u00e9s de 0x8000 ciclos de creaci\u00f3n/destrucci\u00f3n. Al destruir y recrear r\u00e1pidamente conjuntos de sem\u00e1foros en el mismo \u00edndice, otro proceso puede hacer que el n\u00famero de secuencia se reinicie, permitiendo que un conjunto con un n\u00famero diferente de sem\u00e1foros pase la validaci\u00f3n. La copia subsiguiente entonces lee o escribe m\u00e1s all\u00e1 del final del b\u00fafer asignado.\n\nUn usuario local sin privilegios puede desencadenar lecturas y escrituras fuera de l\u00edmites en la memoria del heap del kernel, lo que podr\u00eda conducir a una escalada de privilegios."}], "id": "CVE-2026-58087", "lastModified": "2026-10-27T12:10:00.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58087", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-08-19T08:17:12.877", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-191"}, {"lang": "en", "value": "CWE-787"}], "source": "secteam@freebsd.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.1-RELEASE,p2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0-RELEASE,p12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.4-RELEASE,p8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeBSD", "source": "cna", "vendor": "FreeBSD"}, "product": "freebsd", "vendor": "freebsd"}], "created": "2026-08-19T10:45:03.772770+00:00", "updated": "2026-08-20T18:00:04.066589+00:00", "vendors": ["freebsd", "freebsd$PRODUCT$freebsd"]}