CVE-2026-49414

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

• CWE-179

• https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.ascVendor Advisory

Published

Jun 27, 2026

Last Modified

Jul 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49401Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…8.4
• CVE-2026-49402Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…8.1
• CVE-2026-49406Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…5.5
• CVE-2026-49411Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…6.5
• CVE-2026-49412The kernel handler for IPV6_MSFILTER dropped a serializing l…7.8
• CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
• CVE-2026-49416The CONS_HISTORY ioctl handler did not adequately validate t…7.8
• CVE-2026-49417Second, the audio buffer backing a mapping could be freed wh…7
• CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…5.9
• CVE-2026-49432Improper Input Validation vulnerability in Apache ActiveMQ, …7.5
• CVE-2026-49433The DeepAI endpoint 'https://api.deepai.org/change_user_emai…5
• CVE-2026-49434Improper Input Validation vulnerability in Apache ActiveMQ B…7.5