EUVD-2026-39960

The CONSHISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An...

CVE-2026-49416 Integer overflow in vt(4) CONS_HISTORY ioctl

The CONSHISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An...

CVE-2026-49416

The vt(4) system console driver in FreeBSD contains an integer overflow vulnerability in the CONS_HISTORY ioctl handler. When a large history size is requested, an integer overflow occurs during buffer size calculation, leading to a smaller heap allocation. Subsequent buffer initialization result...

PT-2026-53065

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The CONS HISTORY ioctl handler fails to properly validate the requested history size. Providing a large value leads to an integer overflow during the buffer size...

FreeBSD-SA-26:34.vt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:34.vt Security Advisory The FreeBSD Project Topic: Integer overflow in vt4 CONSHISTORY ioctl Category: core Module: vt Announced: 2026-06-09 Credits: Ed Mast...

FreeBSD -- Integer overflow in vt(4) CONS_HISTORY ioctl

Problem Description: The CONSHISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of...