An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FreeBSD | FreeBSD | unknown |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 19 Aug 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer. An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation. | |
| Title | Race condition in ELF core dump segment counting | |
| Weaknesses | CWE-362 CWE-787 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-08-19T11:45:00.908Z
Reserved: 2026-06-29T01:40:17.498Z
Link: CVE-2026-58088
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T08:17:12.983
Modified: 2026-08-19T08:17:12.983
Link: CVE-2026-58088
Redhat
No data.
OpenCVE Enrichment
No data.