HIGHCVSS v3.1 7.0Vulnerability
CVE-2026-58100
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Cvss severity
- HIGH
- Cvss score
- 7
- Epss score
- 0.00096
- Retrieved at
- 2026-10-21T01:24:49+00:00
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Score
- 7
- Cve id
- CVE-2026-58100
- Cvss vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-18T13:39:03+00:00
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-10-15T07:18:02.490
- Last modified
- 2026-10-19T21:01:55.713
- Epss percentile
- 0.00678
Related Entities (6)
AFFECTS_PRODUCT (4)
HAS_WEAKNESS (2)
Explore deeper with Ninja Signal's threat intelligence graph