PatchTheCVECVE-2026-49416: The CONS_HISTORY ioctl handler did not adequately validate the requested history size
CVE-2026-49416 is a high-severity flaw (CVSS 7.8) affecting freebsd. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, potentially escalating privileges.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 96%) |
| CISA exploited list | No |
| Weakness | CWE-190 |
| Published | 2026-06-27 |
| Last modified | 2026-07-01 |
Last updated 2026-07-01 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-49416?
freebsd: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2026-49416 being exploited?
CVE-2026-49416 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-49416 affect?
CVE-2026-49416 affects freebsd. Severity is high (CVSS 7.8). The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initializatio
How urgent is CVE-2026-49416?
Priority 28/100. High severity
Related CVEs
- CVE-2026-58082 CRITICAL 9.8 MITIGATE The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character outp
- CVE-2026-58081 CRITICAL 9.8 MITIGATE Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-sup
- CVE-2026-58085 HIGH 7.5 MITIGATE After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whethe
- CVE-2026-58086 HIGH 8.1 MITIGATE As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user
- CVE-2026-58083 HIGH 8.4 MITIGATE While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued