In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9 12.2-STABLE before r370383 11.4-STABLE before r370381 13.0-RELEASE before p4 12.2-RELEASE before p10 and 11.4-RELEASE before p13 the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.