Vulnerability in FreeBSD

[ Description ]Official description

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0452

  Vulnerabilities fixed in FreeBSD bhyve hypervisor Translated from Dutch

  Probability/damage M/HCVE-2026-101307CVE-2026-101308CVE-2026-101309+2 more CVEs
• BSI CERT-Bund14 Oct 2026WID-SEC-2026-3967

  FreeBSD Project FreeBSD OS: Multiple vulnerabilities Translated from German

  CVE-2026-101311CVE-2026-101307CVE-2026-101308+2 more CVEs

[ References ]References

• security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc