# CVE-2026-49414

## Summary

- **CVE ID:** CVE-2026-49414
- **Severity:** UNKNOWN
- **CVSS Score:** 0
- **CWE:** CWE-179
- **Published:** Jun 27, 2026
- **Last Modified:** Jun 27, 2026

## Description

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before.  As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen.

An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2).  This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

## Affected Products

- FreeBSD — FreeBSD (15.0-RELEASE)
- FreeBSD — FreeBSD (14.4-RELEASE)
- FreeBSD — FreeBSD (14.3-RELEASE)

## References

- [CNA](https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.asc)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.15%
- **EPSS Percentile:** 4.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._