The vulnerability arises in the FreeBSD 15.0 kernel where a refactor of the credential structure caused the function group_is_primary() to misinterpret the primary group ID. During mac_do transitions that do not specify a group, the function erroneously copies the first element of the original supplementary groups array into the primary group field. This allows an attacker to cause a credential switch that assigns group ID 0 ("wheel") or another unintended group as the process’s primary group. When group 0 visibility is tied to privileged operations, this misassignment can enable privilege escalation, potentially yielding root privileges on systems that rely on group 0 for elevated access.

Impact is limited to the FreeBSD operating system. The flaw exists in the 15.0 kernel, and any system that has not applied the patch that corrects group_is_primary() is affected. The advisory does not enumerate a broader version range, so the scope includes FreeBSD 15.0 installations and any downstream releases that carry the unpatched code.

Risk is moderate through local exploitability: an attacker must control a process that satisfies a mac_do rule such as uid=USER>uid=TARGET or gid=0>uid=0, and the attacker’s UID must match the rule’s source. If the user has an empty supplementary group list, the bug can set the primary group to 0. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, but the potential to elevate privileges on systems that grant group‑0 members special rights motivates prompt remediation.