The flaw is a heap out‑of‑bounds write that occurs within the kernel semaphore system call `semop(2)` when a waiting process is awakened after the semaphore set has been destroyed and re‑created enough times to wrap a 15‑bit sequence number. The overwritten location lies in kernel heap memory and can corrupt critical data structures, giving an unprivileged local user the ability to gain elevated privileges. The issue is a classic example of CWE‑787 and is a direct out‑of‑bounds memory corruption vulnerability. The impact is a local privilege escalation because the corruption happens inside the kernel address space and can lead to arbitrary code execution with root rights.

The defect resides in the FreeBSD kernel semaphore implementation and applies to all FreeBSD releases that contain the unpatched IPC subsystem. The advisory lists only the generic product “FreeBSD” with no specific version range, so any system running a kernel prior to the update that resolves this issue is considered vulnerable. No particular product or vendor beyond FreeBSD is mentioned.

The vulnerability is local and requires the attacker to have some form of local access. The exploit does not depend on network interaction; it is triggered by creating and destroying semaphore sets until the 15‑bit sequence counter wraps. The resulting kernel‑heap out‑of‑bounds write makes the flaw a high‑severity privilege escalation with a CVSS score of 8.4. The EPSS score is < 1%, indicating a very low likelihood of exploitation in the wild, and the bug is not listed in the CISA KEV catalog. However, the local nature of the attack still poses a serious risk to systems that cannot restrict IPC usage.