CVE-2026-49420
Full vulnerability record from the local CVENow database.
Description
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 06:17:40.790000
Last modified
2026-11-09 20:10:00.200000
View original CVE JSON
{
"id": "CVE-2026-49420",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T06:17:40.790",
"lastModified": "2026-11-09T20:10:00.200",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet.\n\nA host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user)."
},
{
"lang": "es",
"value": "El gestor RTSP en libalias reescribía los paquetes salientes en un búfer de pila de longitud fija sin comprobar si los datos reescritos cabían en el búfer, o si el resultado cabía de nuevo en el paquete original.\n\nUn host que envía tráfico RTSP manipulado desde el interior de una pasarela NAT que utiliza libalias puede desbordar un búfer de pila, logrando potencialmente ejecución remota de código en el kernel (cuando se utiliza ipfw(4) NAT) o en el proceso natd(8) (que generalmente se ejecuta como el usuario root)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"defaultStatus": "unknown",
"modules": [
"libalias"
],
"versions": [
{
"version": "15.1-RELEASE",
"lessThan": "p1",
"versionType": "release",
"status": "affected"
},
{
"version": "15.0-RELEASE",
"lessThan": "p11",
"versionType": "release",
"status": "affected"
},
{
"version": "14.4-RELEASE",
"lessThan": "p7",
"versionType": "release",
"status": "affected"
},
{
"version": "14.3-RELEASE",
"lessThan": "p16",
"versionType": "release",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-19T00:00:00+00:00",
"id": "CVE-2026-49420",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-121"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
"matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
"matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*",
"matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*",
"matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*",
"matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:*",
"matchCriteriaId": "A11526CF-505E-47DF-8388-65CB216D2022"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p15:*:*:*:*:*:*",
"matchCriteriaId": "632175D0-5327-4458-8968-8FA39D00F236"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
"matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
"matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
"matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
"matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
"matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
"matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
"matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
"matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
"matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*",
"matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
"matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*",
"matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*",
"matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*",
"matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15"
}
]
}
]
}
],
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:41.libalias.asc",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}