CVE-2026-101311

Name of the Vulnerable Software and Affected Versions bhyve (affected versions not specified)

Description The framebuffer device model contains duplicated maximum resolution constants between the framebuffer and RFB modules that are out of sync. Furthermore, writes to the framebuffer BAR allow the setting of arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads lack synchronization. A malicious guest could exploit these issues to crash the bhyve process or potentially execute arbitrary code within the host userspace context running the virtual machine, although this is subject to the Capsicum sandbox, a security mechanism that limits the system calls a process can make.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.