Stack Corruption Risk in libnv Affecting FreeBSD Applications

CVE-2026-39457

What is CVE-2026-39457?

The libnv library encounters a vulnerability during socket data exchanges, as it fails to ensure that socket descriptors do not exceed the FD_SETSIZE limit of 1024 when using the select() system call. This oversight permits attackers to exploit the allocation of excessive file descriptors, leading to potential stack corruption. In scenarios where the application has root privileges (setuid-root), this could allow an attacker to escalate privileges and gain unauthorized access to sensitive resources within the system.

References