The vulnerability is a stack overflow in FreeBSD’s libnv library that occurs when a socket descriptor larger than the select(2) file descriptor set limit (FD_SETSIZE 1024) is passed to select(). This defect corrupts the stack during socket I/O handling. When the affected application runs with setuid‑root privileges, the corrupted stack can be leveraged to execute arbitrary code and elevate local privileges, effectively allowing a local attacker to gain root access.

All FreeBSD installations that utilize the libnv library are potentially affected; the advisory does not specify narrower version ranges, so any deployment of libnv within the base system should be considered at risk.

The likely attack vector is a local attacker who can open many file descriptors—such as by launching a program that exhausts the descriptor table before invoking a libnv function—thereby forcing the overflow. This scenario is inferred from the description, as the attack does not require external network access. The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no publicly documented exploits exist at this time.