CVE-2026-35547 - Vulnerability Details - OpenCVE

When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Freebsd	Freebsd

No data.

No data.

References

Link	Providers
https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc

History

Thu, 30 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Apr 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Freebsd Freebsd freebsd
Vendors & Products		Freebsd Freebsd freebsd

Thu, 30 Apr 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges.
Title		Heap overflow in libnv
Weaknesses		CWE-122 CWE-130
References		https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc

MITRE

Status: PUBLISHED

Assigner: freebsd

Published: 2026-04-30T08:08:13.461Z

Updated: 2026-05-01T03:55:50.149Z

Reserved: 2026-04-28T15:08:10.642Z

Link: CVE-2026-35547

Vulnrichment

Updated: 2026-04-30T13:12:22.260Z

NVD

Status : Awaiting Analysis

Published: 2026-04-30T09:16:03.167

Modified: 2026-04-30T15:09:49.123

Link: CVE-2026-35547

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35547", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-04-28T15:08:10.642Z", "datePublished": "2026-04-30T08:08:13.461Z", "dateUpdated": "2026-05-01T03:55:50.149Z"}, "containers": {"cna": {"datePublic": "2026-04-29T19:00:00.000Z", "title": "Heap overflow in libnv", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["libnv"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p7"}, {"status": "affected", "versionType": "release", "version": "14.4-RELEASE", "lessThan": "p3"}, {"status": "affected", "versionType": "release", "version": "14.3-RELEASE", "lessThan": "p12"}, {"status": "affected", "versionType": "release", "version": "13.5-RELEASE", "lessThan": "p13"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mariusz Zaborski"}], "descriptions": [{"lang": "en", "value": "When processing the header of an incoming message, libnv failed to properly validate the message size.\n\nThe lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}, {"cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-04-30T08:08:13.461Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-30T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-35547"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T03:55:50.149Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-35547", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-30T13:12:03.121522Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T13:12:22.260Z"}}], "cna": {"title": "Heap overflow in libnv", "credits": [{"lang": "en", "type": "finder", "value": "Mariusz Zaborski"}], "affected": [{"vendor": "FreeBSD", "modules": ["libnv"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.0-RELEASE", "lessThan": "p7", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p3", "versionType": "release"}, {"status": "affected", "version": "14.3-RELEASE", "lessThan": "p12", "versionType": "release"}, {"status": "affected", "version": "13.5-RELEASE", "lessThan": "p13", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-04-29T19:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When processing the header of an incoming message, libnv failed to properly validate the message size.\n\nThe lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}, {"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-04-30T08:08:13.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35547", "state": "PUBLISHED", "dateUpdated": "2026-05-01T03:55:50.149Z", "dateReserved": "2026-04-28T15:08:10.642Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-04-30T08:08:13.461Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}