CVE-2026-7164

pf can overflow the stack parsing crafted SCTP packets

State: Published
Severity: 7.5 High
Published: Apr 30, 2026
Updated: Apr 30, 2026
Reserved: Apr 27, 2026

Description

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.

Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-674 Uncontrolled Recursion
CWE-791 Incomplete Filtering of Special Elements

Affected Products

Product	Versions
FreeBSDFreeBSD	15.0-RELEASE to before p7Affected 14.4-RELEASE to before p3Affected 14.3-RELEASE to before p12Affected 13.5-RELEASE to before p13Affected

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.ascvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.