The RACK implementation in the FreeBSD TCP stack contains a buffer overflow that occurs when the PCM sample array is resized. The counter used to compute the new allocation size doubles until it overflows to zero, causing an allocation of an almost-zero length buffer and then copying the existing samples into it. An attacker who can open a TCP connection can trigger the resize by sending a large number of ACK packets, leading to an out‑of‑bounds write of about 512 KB on the kernel heap, which may result in a kernel panic.

The vulnerability is present in FreeBSD environments that use the RACK TCP stack; specific version information is not supplied, so all releases that remain vulnerable until a patch is applied are affected.

The CVSS score of 8.2 indicates high severity, and the EPSS score of less than 1 % shows that exploitation probability is low at present. It is not listed in CISA’s KEV catalog. Based on the description, a remote attacker can initiate the exploit by establishing a TCP connection and flooding the target with ACK packets, a method that could be used for denial‑of‑service if successfully executed.