Input Validation Flaw in FreeBSD Router Advertisement Programs
CVE-2025-14558

7.2HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
9 March 2026

What is CVE-2025-14558?

An input validation flaw exists in the rtsol(8) and rtsold(8) programs on FreeBSD, which improperly handles domain search list options in router advertisement messages. This flaw allows the unmodified option body to be passed to resolvconf(8), a shell script that does not validate its input sufficiently, potentially leading to arbitrary command execution. This vulnerability underscores the importance of rigorous input validation to safeguard against unintended command execution through user-controlled inputs.

Affected Version(s)

FreeBSD 15.0-RELEASE

FreeBSD 14.3-RELEASE

FreeBSD 13.5-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-25:12....
vendor-advisory

EPSS Score

61% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kevin Day
.