The KTLS receive path in FreeBSD decrypts data in place under the assumption that the mbuf buffers are anonymous and safe to modify. However, mbufs created by sendfile(2) can contain file‑backed memory. When a local attacker sends such data across a loopback connection with KTLS receive enabled, the decryption occurs directly on the file‑backed buffer, overwriting the original file's page cache. This allows a user who can read a file to overwrite that file with chosen content, bypassing protection flags and causing data corruption. By overwriting a setuid binary or another privileged file, the attacker can gain root or higher privileges.

This vulnerability is present in the FreeBSD operating system. No specific version range is listed, so all releases that include the vulnerable KTLS code and have not been patched should be considered at risk. The issue arises when KTLS receive is enabled on the loopback interface in an environment where a local user can read target files.

The CVSS score is 7.8, and EPSS score data is unavailable. The vulnerability can be exploited locally by any unprivileged user who can read a file and access the loopback interface; it does not require network or prior credential compromise. Because it enables privilege escalation through overwriting of trusted binaries, the potential impact is high, but the lack of remote attack vector and absence of EPSS data make the overall exploitation likelihood uncertain. The vulnerability is not currently listed in the CISA KEV catalog.