CVE-2026-4747

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 1.11%
EPSS Percentile: 65.04%
CISA KEV: Not listed

Description

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secteam@freebsd.org
Published: 26-Mar-2026 14:16
Last Modified: 17-Jun-2026 17:57
EPSS Date: 2026-10-12
CWE: CWE-121

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 13.5
cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.3
cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.4
cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 14.4
cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 15.0
cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 15.0
cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 15.0
cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 15.0
cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*
freebsd / freebsd
Version / affected range: 15.0
cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 01:24
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Confirmed: two bugs in NFS RPCsec_gss, the same subsystem as CVE-2026-4747. The scanner flagged svc_rpc_gss_update_seq(), the same RPC code where Mythos found its flagship vulnerability. A missing 2017 Coverity fix Mythos Marks an Acceleration in AI-Driven Vulnerability Discovery, Not a Beginning

People (8)

Vendors (3)

Products (17)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.