Integer Overflow Vulnerability in FreeBSD vt(4) Device

CVE-2026-49416

What is CVE-2026-49416?

An integer overflow vulnerability exists in the CONS_HISTORY ioctl handler of FreeBSD that fails to properly validate the requested history size. This can lead to a heap allocation that is smaller than necessary due to an erroneous buffer size calculation. An unprivileged local user with access to a vt(4) device may exploit this vulnerability to write beyond the allocated buffer, potentially allowing them to escalate their privileges within the system.

References