CVE-2026-39457: Stack overflow via select() file descriptor set overflow
When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FDSETSIZE (1024).
An attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption. If the target application is setuid-root, then this could be used to elevate local privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39457?
CVE-2026-39457 has a high severity rating due to its potential for causing denial of service through stack overflow.
How do I fix CVE-2026-39457?
To fix CVE-2026-39457, update libnv to the latest version that addresses the overflow issue.
What versions are affected by CVE-2026-39457?
CVE-2026-39457 affects various FreeBSD versions including 13.5 and 14.3.
What types of attacks does CVE-2026-39457 enable?
CVE-2026-39457 can enable denial of service attacks by causing a stack overflow in affected applications.
Is there a workaround for CVE-2026-39457?
A practical workaround for CVE-2026-39457 is to limit the number of file descriptors used by the application.