CVE-2026-39461: libcasper Privilege Escalation Vulnerability

CVE-2026-39461 Overview

CVE-2026-39461 is a stack-based buffer overflow [CWE-121] in FreeBSD's libcasper(3) library. The library communicates with helper processes through UNIX domain sockets and waits for data using the select(2) system call. It does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024).

An attacker who forces an application using libcasper(3) to allocate large file descriptors can trigger stack corruption. When the affected application runs with setuid root privileges, the flaw enables local privilege escalation to root.

Critical Impact
Local attackers can corrupt the stack of setuid binaries linked against libcasper(3), leading to root privilege escalation on affected FreeBSD systems.

Affected Products

FreeBSD operating system (libcasper(3) library)
Applications linking against libcasper(3), particularly setuid root binaries
See the FreeBSD Security Advisory for affected branches

Discovery Timeline

2026-05-21 - CVE-2026-39461 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-39461

Vulnerability Analysis

The libcasper(3) library implements Capsicum's Casper service framework on FreeBSD. It brokers privileged operations on behalf of sandboxed applications by forwarding requests to helper processes over UNIX domain sockets. To wait for responses, the library uses select(2).

The select(2) API operates on fixed-size bitmaps of type fd_set. These bitmaps can only represent file descriptor values from 0 to FD_SETSIZE - 1, which is 1024 on FreeBSD. Using the FD_SET macro with a descriptor value greater than or equal to FD_SETSIZE writes outside the bounds of the bitmap structure.

When libcasper(3) invokes FD_SET on its socket descriptor without first checking that the descriptor is below FD_SETSIZE, the macro writes past the end of the stack-allocated fd_set. This produces stack corruption [CWE-121].

Root Cause

The root cause is missing validation of the socket descriptor value before passing it to FD_SET and select(2). The library assumes the descriptor will always fall within the legal range. When the descriptor exceeds 1023, the macro indexes outside the fd_set array and overwrites adjacent stack data, including return addresses and saved registers.

Attack Vector

A local attacker invokes a setuid root binary that uses libcasper(3). Before executing the target, the attacker opens many file descriptors, for example by repeatedly calling dup(2) or opening files until the kernel issues descriptor numbers above 1023. Descriptors not marked close-on-exec persist across execve(2).

When the setuid program subsequently opens its libcasper(3) helper socket, the kernel assigns it a descriptor value above 1023. The first select(2) call in libcasper(3) then corrupts the stack. A crafted descriptor layout allows the attacker to control the corruption pattern and redirect execution, gaining root privileges.

No verified public exploit code is available. Refer to the FreeBSD Security Advisory for additional technical details.

Detection Methods for CVE-2026-39461

Indicators of Compromise

Unexpected crashes or core dumps from setuid binaries linked against libcasper(3)
Processes with abnormally high open file descriptor counts immediately prior to invoking a setuid binary
New root-owned processes spawned from non-privileged user sessions
Modifications to system binaries, /etc/passwd, or /etc/master.passwd following a suspect process crash

Detection Strategies

Audit execve events on FreeBSD hosts where the parent process holds more than 1024 open descriptors
Monitor for SIGSEGV and SIGABRT terminations of setuid binaries that link libcasper
Correlate rlimit changes via setrlimit(RLIMIT_NOFILE, ...) with subsequent execution of privileged binaries
Review FreeBSD audit (auditd) records for unusual descriptor inheritance patterns

Monitoring Recommendations

Enable kern.coredump and centralize core files for forensic review of crashes in libcasper-linked binaries
Track getrlimit/setrlimit system calls in process accounting to surface descriptor exhaustion attempts
Alert on privilege transitions where a non-root user spawns a root shell or executes administrative commands after a setuid binary crash

How to Mitigate CVE-2026-39461

Immediate Actions Required

Apply the FreeBSD security update from the FreeBSD Security Advisory on all affected systems
Inventory setuid root binaries that link against libcasper(3) using ldd and prioritize their patching
Restrict shell access on multi-user FreeBSD hosts until the update is deployed

Patch Information

FreeBSD has issued a security update tracked as FreeBSD-SA-26:22.libcasper. The fix validates that the socket descriptor falls below FD_SETSIZE before invoking FD_SET, or replaces select(2) with descriptor-safe primitives. Administrators should run freebsd-update fetch install on supported releases, then reboot or restart all services that load libcasper(3).

Workarounds

Lower the per-process file descriptor limit using login.conf so openfiles cannot reach 1024 for untrusted users
Remove the setuid bit from non-essential binaries that depend on libcasper(3) until patches are applied
Restrict execution of affected setuid binaries to administrative users through pam_exec or filesystem ACLs

bash

# Reduce the openfiles limit for the default login class in /etc/login.conf
# Then rebuild the capability database with cap_mkdb
default:\
	:openfiles=512:\
	:openfiles-max=512:

cap_mkdb /etc/login.conf

# Apply the official update
freebsd-update fetch
freebsd-update install
shutdown -r now