The CVE describes a heap overflow that occurs when the FreeBSD kernel processes a FUSE_LISTXATTR request containing an extended attribute list that is not properly NUL-terminated. Because the kernel does not verify that the entire list of NUL-terminated strings is completed, it may read past the bounds of one heap buffer and write beyond the bounds of a second buffer. The overflow can expose up to 253 bytes of kernel heap memory or allow a malicious daemon to inject up to 250 attacker-controlled bytes into unallocated kernel heap space, potentially compromising kernel integrity and privilege.

FreeBSD operating systems that include the kernel FUSE filesystem module are impacted. No specific kernel revisions are cited; therefore any FreeBSD release that implements the FUSE module may be affected.

The CVSS score of 5.5 reflects a medium severity, while the EPSS score of <1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must control a userspace FUSE daemon capable of sending a malformed FUSE_LISTXATTR message. When such a message is processed by the kernel, the resulting overflow can corrupt kernel heap metadata or overwrite critical structures, which could lead to information disclosure or privilege escalation.