HIGH🇵🇱 Wersja polska

CVE-2026-7164

CVSS 7.5v3.1pub. 2026-04-30upd. 2026-05-01

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Freebsd
OS
Freebsd
13.514.314.415.0

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

References

security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc…

Related vulnerabilities

CVE-2024-43102CRITICAL10.0PL ✓same product

FreeBSD UMTX_SHM_DESTROY: use-after-free umożliwiający RCE lub ucieczkę z sandboxa

CVE-2024-29937CRITICAL9.8PL ✓same product

RCE w implementacji NFS w OpenBSD i FreeBSD — zdalne wykonanie kodu

CVE-2022-23088CRITICAL9.8PL ✓same product

FreeBSD: przepełnienie bufora w obsłudze beacon 802.11s prowadzące do RCE

CVE-2023-5941CRITICAL9.8PL ✓same product

FreeBSD libc stdio: heap buffer overflow w funkcji __sflush()

CVE-2023-3326CRITICAL9.8PL ✓same product

FreeBSD pam_krb5 – pominięcie uwierzytelnienia przez brak weryfikacji TGT