CVE-2026-57589

This is a software mistake that can leave behind a reference to something that has already been removed. It is like a staff member using an old master-key record after the key was cancelled: someone already on the premises may be able to gain access far beyond what they should have.

This matters to you if you run OpenBSD on a server, firewall, appliance, or other business system. It is primarily a concern where untrusted people, accounts, or software can run locally on that system.

An attacker must be able to run code locally before using this flaw to seek full control, which makes this an amber-priority issue. There is no record of confirmed active exploitation, no public exploit code, and it is not listed in CISA's known-exploited catalog; schedule remediation promptly rather than treating it as an emergency internet attack.

Confirm the installed OpenBSD release on every relevant host and identify systems at version 7.9 or earlier. The findings identify vendor remediation as source commit 1957873d2063db11dab780eca75b5e629d1e838d, but do not provide fixed release versions or branch-specific targets; use the vendor-supported update path or apply that remediation to the maintained source branch.

If upgrading is delayed, reduce local attack opportunities by restricting shell access, removing unnecessary local accounts, and preventing untrusted workloads from executing on affected hosts. No CISA KEV due date applies because this CVE is not listed in KEV. After remediation, review privileged-account and process activity for unexpected root-level changes.

CVE-2026-57589 is rated CVSS 7.4 (High): AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It is CWE-416, a use-after-free in sys/kern/sysv_sem.c, described as occurring after tsleep during sys_semget() context-switch handling and enabling local privilege escalation to root. CISA KEV does not list it, and no public exploit code is on record. EPSS is 0.2% (7th percentile) with a flat trend; this is a predictive estimate, not evidence of exploitation. Exploit maturity is not established by the findings.