The vulnerability is a race condition in FreeBSD's ELF core dump handling. The code counts dumpable VM map entries, allocates a buffer, then refills it in a second pass. A process that has shared its address space via rfork(2) can modify the map between the two passes, causing the second pass to write program headers beyond the allocated buffer. This out-of-bounds write occurs on the kernel heap and can enable an unprivileged local user to gain elevated privileges.

FreeBSD systems are affected. The advisory does not list specific versions, so any release without the patch may be vulnerable.

The CVSS score of 7.4 indicates a high severity. The EPSS score is below 1%, meaning that actual exploitation is expected to be rare, and the vulnerability is not currently listed in the CISA KEV catalog. The race condition can only be triggered by a local unprivileged user that shares an address space with a process that dumps core, so the attack vector is local with exploit conditions requiring a concurrent rfork(2) operation. Although the probability of exploitation is low, the potential for privilege escalation warrants immediate attention.