{"id":"CVE-2026-101311","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-101311","generatedAt":"2026-10-28T03:58:42.257Z","title":"Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.","description":"The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.","published":"2026-10-15T08:16:36.000Z","lastModified":"2026-10-16T04:18:11.000Z","status":"Awaiting Analysis","sourceIdentifier":"secteam@freebsd.org","cvss":{"version":"3.1","score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-362"],"affected":[],"epss":{"score":0.00117,"percentile":0.01669,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00181,"percentile":0.07121}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-15T16:15:11.000Z","detail":{"from":null,"score":"7.0","severity":"HIGH","fromSeverity":null},"summary":"Now scored CVSS 7.0 HIGH."},{"kind":"new","label":"New CVE","at":"2026-10-15T08:16:36.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-15T08:16:36.423Z"},"summary":"New CVE, high severity (CVSS 7.0)."}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc","source":"secteam@freebsd.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-101311","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}