CVE-2026-101311
7.0HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-362
Impact
A malicious guest OS user can crash bhyve or potentially execute arbitrary code inside the host's bhyve userspace sandbox. The attacker requires local access inside a running virtual machine configured with a framebuffer/RFB console.
Root cause
Mismatched resolution constants, missing bounds validation on framebuffer BAR writes, and unsynchronized framebuffer BAR I/O and RFB rendering threads allow race conditions.
Affected systems
FreeBSD bhyve; exact version numbers are not listed — check FreeBSD-SA-26:72.bhyve.asc.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch from FreeBSD-SA-26:72.bhyve.asc and rebuild bhyve, or disable the VNC/RFB framebuffer device model on untrusted guest VMs until patched.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.