A race condition in the execve(2) system call for SUID binaries allows a local user to observe and modify the target process's memory between the new address space installation and the credential elevation. By exploiting this window, the attacker can alter the binary's virtual address space and inject code, ultimately achieving full control of the affected system. This flaw corresponds to CWE‑367, the classic Time‑of‑Check to Time‑of‑Use race. The vulnerability grants local privilege escalation and potentially full root access.

The issue affects FreeBSD systems that implement the execve(2) handler with the described race condition. No specific version range is listed in the advisory, so all releases that contain a vulnerable SUID binary should be considered. The advisory references FreeBSD‑SA‑26:39.execve, implying that the fix applies to the current FreeBSD code base.

The advisory does not provide a CVSS score; EPSS is unavailable and KEV is not listed, which does not preclude the possibility of exploitation. The flaw is exploitable only by a local user who runs processes with the same UID as a vulnerable SUID binary and has access to procfs or linprocfs. Because the race window exists right after the memory mapping step but before credential elevation, an attacker can gain root privileges without interacting with network services, making the attack local but highly potent. The worst‑case impact is complete system compromise.