FreeBSD security advisory (AV26-291)

Serial number: AV26-291
Date: March 27, 2026

Between March 25 and 26, 2026, FreeBSD published security advisories to address vulnerabilities in the following products:

• FreeBSD – version 14.x
• FreeBSD – version 15.0
• FreeBSD – version 13.5

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• TCP: remotely exploitable DoS vector (mbuf leak) (CVE-2026-4247)
• Remote denial of service via null pointer dereference (CVE-2026-4652)
• Remote code execution via RPCSEC_GSS packet validation (CVE-2026-4747)
• pf silently ignores certain rules (CVE-2026-4748)
• FreeBSD Security Advisories