A use‑after‑free condition in the FreeBSD TIOCNOTTY handler allows a process that has cleared its controlling terminal to later access a dangling pointer in the terminal structure after the process exits. An attacker can use the freed reference to elevate privileges and gain root access.

FreeBSD is the affected vendor. No specific product release or version information is listed in the advisory; the vulnerability applies to all affected FreeBSD releases for which the TIOCNOTTY handler implementation is unpatched.

The CVSS score is 8.4, and the EPSS score is below 1%, indicating a low probability of exploitation, but the vulnerability is known to allow local processes to gain root credentials. Since the attack requires the attacker to invoke the TIOCNOTTY ioctl on a controlling terminal, the likely vector is local access. The CVE is not listed in the CISA KEV catalog, yet it remains a critical privilege‑escalation flaw.