The flaw lies in the RPCSEC_GSS packet validation routine. A stack buffer is used to copy data from the packet without verifying that the buffer is large enough. This leads to a stack overflow that can be triggered by a specially crafted packet sent by any client, because the routine does not require prior authentication. An attacker who can send such packets to the NFS server (or any RPC server that loads the vulnerable library) can execute arbitrary code at the privilege level of the receiving process, which may be kernel mode.

FreeBSD kernel modules that provide GSS authentication. The kgssapi.ko kernel module is affected in the core system; any NFS server that loads it is vulnerable. In user space, any application that loads the librpcgss_sec library and runs an RPC server is also susceptible. While the FreeBSD base system itself is not known to ship such applications, third‑party services may still expose the risk.

The CVSS score of 8.8 reflects the severity of the vulnerability. The EPSS score of less than 1% indicates that the likelihood of exploitation in the immediate future is low, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet seen widespread use from known threat actors. Nevertheless, the fact that authentication is not required for user‑space exploitation means an active network presence could theoretically deliver malicious packets. In the kernel case, an authenticated NFS client can exercise the code execution. The attack surface is therefore significant for systems with active RPC/NFS services and the kgssapi.ko module enabled.