The flaw lies in the renameat system call, which fails to enforce FD_RESOLVE_BENEATH on directory arguments. A jailed process can rename a directory via a restricted descriptor and then call fchdir to move its current working directory outside the jail’s filesystem root. This allows the process to escape the jail boundary and perform actions on the host file system. The weakness is classified as CWE‑273, representing unauthorized reference or path traversal.

The vulnerability affects FreeBSD systems that use the jail facilities. All FreeBSD releases containing the stated renameat behavior are vulnerable; no specific version ranges are listed in the advisory.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is less than 1 percent and the vulnerability is not listed in CISA KEV. Attackers would need to be able to run code within a jail and obtain a directory file descriptor from another jail. The vector is thus local to the jail environment and requires inter‑jail communication. Although the probability of exploitation appears low, the impact of jail escape is high given the potential to reach system files and elevate privileges.