The setcred(2) system call is vulnerable because a supplied list of supplementary groups is copied into a fixed-size kernel stack buffer before the caller’s privilege level is verified. If the list exceeds the buffer limit, this causes a stack buffer overflow that allows an unprivileged local user to execute arbitrary code in kernel context, resulting in elevation of privileges.

The vulnerability affects FreeBSD systems that include the unpatched implementation of setcred(2); specific affected release numbers are not enumerated in the advisory, but any FreeBSD build prior to the update cited in the FreeBSD SA-26:18 announcement is potentially vulnerable. Administrators should consult the advisory for the exact patch level and ensure their deployments are updated accordingly.

Because the overflow occurs before privilege validation, the attacker only needs local access; no network or elevated privilege is required. The CVSS score is 7.8 and the EPSS score is < 1%, indicating a low but non-zero probability of exploitation. The nature of the vulnerability (kernel code execution) and absence of a KEV listing imply a high intrinsic risk. The attack vector is local and would succeed if an attacker can run a local program that supplies a too‑large supplementary group list to setcred(2).