CVE-2026-58097: ppp(8): missing length validation in mp_SetEnddisc()

Published Aug 26, 2026

Updated

mpSetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.

A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

Affected Software

1 affected component

? ppp

Event History

Aug 26, 2026

CVE Published

via MITRE·05:28 AM

Data Sourced

via MITRE·05:28 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A local user who has access to the ppp(8) command interface can supply a crafted PSN endpoint value. Remote exploitation is not described in the available information.

What level of impact could successful exploitation have?

An attacker may crash ppp(8), causing a denial of service. The vulnerability could also potentially allow arbitrary code execution as root.

How can I determine whether a system is exposed?

Exposure depends on whether local users can access the ppp(8) command interface and can provide PSN endpoint values to it. The supplied information does not identify affected versions or configuration-specific indicators.

CVE-2026-58097: ppp(8): missing length validation in mp_SetEnddisc()

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of impact could successful exploitation have?

How can I determine whether a system is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of impact could successful exploitation have?

How can I determine whether a system is exposed?