Answer in brief
CVE-2026-45259 records a Medium severity (CVSS 6.5) vulnerability in sigqueue(2) missing capability mode restriction. The current sources do not mark it as known exploited. The current feed maps FreeBSD/FreeBSD (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps FreeBSD/FreeBSD (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| FreeBSD/FreeBSDgeneric | >=15.0-RELEASE <p10 || >=14.4-RELEASE <p6 || >=14.3-RELEASE <p15 | p10, p6, p15 |
Published upstream
Jun 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 29, 2026
sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue(2) to send signals to any process it could signal following standard Unix permissions, bypassing the Capsicum sandbox restriction. A compromised sandboxed process could interfere with other processes, for example by sending SIGKILL or SIGSTOP. This could be any process running as the same user, or any process, for a superuser sandboxed process.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-45259 records a Medium severity (CVSS 6.5) vulnerability in sigqueue(2) missing capability mode restriction. The current sources do not mark it as known exploited. The current feed maps FreeBSD/FreeBSD (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps FreeBSD/FreeBSD (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| FreeBSD/FreeBSDgeneric | >=15.0-RELEASE <p10 || >=14.4-RELEASE <p6 || >=14.3-RELEASE <p15 | p10, p6, p15 |
Published upstream
Jun 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 29, 2026
sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue(2) to send signals to any process it could signal following standard Unix permissions, bypassing the Capsicum sandbox restriction. A compromised sandboxed process could interfere with other processes, for example by sending SIGKILL or SIGSTOP. This could be any process running as the same user, or any process, for a superuser sandboxed process.
Quoted source text, attributed separately from HOL analysis.