pf can overflow the stack parsing crafted SCTP packets

published 2026-04-30 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-26352

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.

Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

Patch / fix

fixed in 1

FreeBSD FreeBSD p3, p7, p12, p13

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-04-30)

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

FreeBSD FreeBSD

Classification

Weakness

CWE-674 Uncontrolled Recursion
CWE-791 Incomplete Filtering of Special Elements

References

security.freebsd.org /advisories/FreeBSD-SA-26:14.pf.asc
vendor-advisory

Sources

CVE List CVE-2026-7164
NVD CVE-2026-7164

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary