The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. As a result, a process running in a classic (non‑VNET) FreeBSD jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing the expected network isolation. This flaw represents a failure of the system to enforce isolation boundaries (CWE‑941) and could allow a jailed application to reach host‑local services that should be protected from the jail environment.

FreeBSD, specifically classic non‑VNET jails. No version ranges were specified in the advisory.

The EPSS score is reported as less than 1 %, indicating a low but non‑zero probability that the vulnerability will be exploited in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to have a running process inside a jail, from which the attacker can craft and send the offending UDP packets. Once the packets reach the host's loopback, the jailed process can communicate with any host service listening there, potentially leading to unintended service exposure, privilege escalation, or further compromise of the host. Because the flaw involves local network isolation bypass, the scope is limited to the host system, but the impact can be severe if the host hosts sensitive services on the loopback interface.