How severe is CVE-2026-49427?

CVE-2026-49427 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-49427 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-49427?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-49427 published?

CVE-2026-49427 was published on 2026-08-19 and last updated on 2026-08-20.

CVE-2026-49427

CVE-2026-49427 is a high-severity vulnerability with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-826.

Key facts

Severity: High (CVSS 3.x base score 8.8)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-826
Published: 2026-08-19
Last modified: 2026-08-20

Description

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Frequently asked questions

What is CVE-2026-49427?: Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
How severe is CVE-2026-49427?: CVE-2026-49427 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-49427 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-49427?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-49427 published?: CVE-2026-49427 was published on 2026-08-19 and last updated on 2026-08-20.

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:44.posixshm.asc

Other CWE-826 vulnerabilities

CVE-2026-31663 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish…
CVE-2024-51727 — Medium (CVSS 6.5): Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to…
CVE-2023-1297 — Medium (CVSS 4.9): Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of…
CVE-2024-58249 — Low (CVSS 3.7): In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.
CVE-2025-24912 — Low (CVSS 3.7): hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS…

Browse all CWE-826 vulnerabilities →