CVE-2026-75883: PPPD buffer overflow in PEAP response code
The code in pppd that formats a response to a PEAP Request packet in peapresponse() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacketbuf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacketbuf array, most likely causing incorrect behavior or a crash.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
A pppd process is exposed when it connects to a server that requests PEAP authentication. Exploitation requires network access to such a connection, but no privileges or user interaction are required.
What can an attacker do?
A server requesting PEAP authentication can cause pppd to copy a TLS record of up to 16,384 bytes into a fixed global buffer without verifying available space. This corrupts adjacent global static data and is most likely to result in incorrect behavior or a process crash.
Is there a configuration-based workaround if patching is not immediately possible?
The described exposure depends on PEAP authentication being requested by the server. Avoid connecting affected pppd clients to servers that request PEAP authentication until a fix is available.