https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:13:04.205012+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-49414 CVE-2026-49414 — ASLR bypass for setuid executables via procctl(2) 2026-10-07T07:13:04.226008+00:00

Affected: FreeBSD

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen.

An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.