CVE-2026-49420

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The RTSP handler in the libalias library rewrites outgoing packets into a fixed-length stack buffer without verifying if the rewritten data fits within the buffer or if the result fits back into the original packet. A remote attacker sending specially crafted RTSP traffic from inside a NAT gateway using libalias can trigger a stack buffer overflow. This may lead to remote code execution within the kernel when using ipfw(4) NAT, or within the natd(8) process, which typically operates with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.