When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated.
If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:20.fusefs.asc | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 May 2026, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:20.fusefs.asc - Vendor Advisory | |
| First Time |
Freebsd
Freebsd freebsd |
|
| CPE | cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:* |
21 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
21 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
21 May 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-21 10:16
Updated : 2026-05-21 19:01
NVD link : CVE-2026-45252
Mitre link : CVE-2026-45252
CVE.ORG link : CVE-2026-45252
JSON object : View
Products Affected
freebsd
- freebsd
CWE
CWE-122
Heap-based Buffer Overflow