A regression in the FreeBSD packet filter caused rules that use the address range syntax (x.x.x.x - y.y.y.y) to be silently dropped as duplicates. The first rule with a given range pattern is applied, while later, identical rules are ignored. Such silent dropping can lead to over‑blocking or under‑blocking of traffic, potentially disrupting legitimate network flows. Rules expressed using an address[/mask-bits] syntax or certain action keywords are not affected, but many typical firewall configurations may still use the vulnerable syntax.

The vulnerability impacts the FreeBSD operating system. Versions affected include FreeBSD 14.3 releases 14.3-p1 through 14.3-p9, FreeBSD 14.4 (including release candidate 1), and FreeBSD 15.0 releases 15.0-p1 through 15.0-p4. All other FreeBSD releases are considered unaffected.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The primary risk is network disruption rather than code execution. Based on the description, the likely attack vector is a privileged local user who can modify pf configuration files. An attacker could introduce duplicate address‑range rules to cause subsequent rules to be ignored. No publicly available remote exploitation is documented.