The vulnerability arises from incorrect ordering of ASLR preference flag clearing in the ELF image activator for setuid PIE binaries. The code clears the per‑process ASLR flags after the PIE base address is computed instead of before. Consequently, a user‑requested ASLR disable remains active when the base address is chosen, allowing an unprivileged local user to invoke procctl(2) to turn off ASLR on a setuid binary before it executes.

Affected systems are FreeBSD installations that include setuid PIE executables. The advisory does not list specific release numbers, so any FreeBSD version that still contains the unpatched code is vulnerable. Administrators should review the advisory and test the patch on their current releases.

The risk is high even though the EPSS score is unavailable; the local user can disable ASLR and thereby reduce the difficulty of any subsequent memory‑corruption attack in the same binary. The vulnerability is classified CWE‑179 and is not currently listed in the CISA KEV catalog. The attack vector is local and requires no special privileges beyond the ability to use the procctl system call.