CVE-2026-58095: ppp(8): incorrect length calculation in mp_Enddisc()
Published Aug 26, 2026
·Updated
mpEnddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer.
A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Affected Software
23 affected components
ppp(8)
FreeBSD FreeBSD=14.4-p1
FreeBSD FreeBSD=14.4-p2
FreeBSD FreeBSD=14.4-p3
FreeBSD FreeBSD=14.4-p4
FreeBSD FreeBSD=14.4-p5
FreeBSD FreeBSD=14.4-p6
FreeBSD FreeBSD=14.4-p7
FreeBSD FreeBSD=14.4-p8
FreeBSD FreeBSD=15.0-p1
FreeBSD FreeBSD=15.0-p10
FreeBSD FreeBSD=15.0-p11
FreeBSD FreeBSD=15.0-p12
FreeBSD FreeBSD=15.0-p2
FreeBSD FreeBSD=15.0-p3
FreeBSD FreeBSD=15.0-p4
FreeBSD FreeBSD=15.0-p5
FreeBSD FreeBSD=15.0-p6
FreeBSD FreeBSD=15.0-p7
FreeBSD FreeBSD=15.0-p8
FreeBSD FreeBSD=15.0-p9
FreeBSD FreeBSD=15.1-p1
FreeBSD FreeBSD=15.1-p2
Event History
Aug 26, 2026
CVE Published
via MITRE·05:28 AM
Data Sourced
via MITRE·05:28 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A malicious PPP peer that can send a crafted endpoint option to ppp(8) can trigger the vulnerable processing.
2
What is the impact if exploitation succeeds?
The issue can crash ppp(8) and may allow arbitrary code execution with root privileges.