Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-3038 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3038 is a stack buffer overflow vulnerability in the FreeBSD kernel's rtsock_msg_buffer() function, which serializes routing information by copying sockaddr structures into a sockaddr_storage structure on the stack. The function assumes the source sockaddr length field has been validated, but it has not, enabling a malicious userspace program to craft a request that triggers a 127-byte overflow. This immediately corrupts the stack canary for the function's stack frame, causing a kernel panic upon return. The issue carries a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-787 (Out-of-bounds Write).
An unprivileged userspace process can exploit the vulnerability by sending a specially crafted request to the routing socket, inducing the buffer overflow and stack canary corruption that results in a kernel panic and denial-of-service condition. The canary verification limits immediate impact to a crash, but the description notes that other kernel bugs enabling userspace disclosure of the canary value could allow attackers to defeat this mitigation and potentially achieve local privilege escalation.
The FreeBSD Security Advisory FreeBSD-SA-26:05.route provides details on mitigation and patches; see https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.asc.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10334
Vulnerability Data
The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is…
more
not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow. In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns. The bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic. Other kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and bounds checks) finds out-of-bounds write flaws before deployment.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Input validation can structurally reject or sanitize data that would otherwise trigger an out-of-bounds write.
Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect and prevent out-of-bounds write defects.
Secure development life cycle mandates practices that prevent out-of-bounds writes.
Application security requirements can specify bounds-checking and safe memory handling.
Secure architecture and engineering principles reduce the likelihood of buffer overflows.
Secure coding directly addresses out-of-bounds writes through language choice and coding standards.
Change management can enforce review gates that catch unsafe memory operations before deployment.