The vulnerability arises from duplicated maximum resolution constants between the framebuffer and RFB modules, unchecked writes to the framebuffer BAR that can set arbitrary width and height values, and lack of synchronization between the framebuffer BAR I/O and RFB rendering threads. These issues allow a malicious guest to crash the bhyve hypervisor process or execute arbitrary code in the host user‑space context that runs the virtual machine, subject to the limits imposed by bhyve’s Capsicum sandbox.

The affected product is the bhyve hypervisor on FreeBSD systems. No specific version range is provided; the advisory applies to any release of bhyve on FreeBSD that contains the unpatched framebuffer device model.

The CVSS score of 7 indicates high severity, while the EPSS score of less than 1 percent indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. It is likely that an attacker must run a malicious guest with sufficient capabilities to trigger the vulnerability, exploiting the lack of validation and synchronization within the bhyve device firmware.