CVE-2026-45252
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In the FreeBSD kernel (fusefs), when handling extended attributes, the fusefs kernel module calls strlen() on a daemon-supplied buffer without verifying that the entire list is NUL-terminated. A malicious daemon can send a non-NUL-terminated list, causing an out-of-bounds read of one buffer and potential out-of-bounds write of a second buffer.
Risk Assessment
A malicious daemon can disclose up to 253 bytes of kernel heap memory (information leak) or inject up to 250 attacker-controlled bytes into unallocated kernel heap space, potentially leading to privilege escalation or system instability.
Recommendation
Apply a security patch for the FreeBSD kernel (fusefs) or update the system to a version containing the fix.
Original NVD description (English source)
When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated. If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space.