SB2026082641 - Multiple vulnerabilities in FreeBSD ppp(8)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082641

SB2026082641 - Multiple vulnerabilities in FreeBSD ppp(8)

Published: August 26, 2026

Security Bulletin ID SB2026082641
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2026-58095)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a buffer overflow in mp_Enddisc() when processing a received endpoint discriminator option. A remote attacker can send a specially crafted endpoint discriminator option to execute arbitrary code.

The issue can also crash ppp(8). Exploitation occurs in the Multilink PPP endpoint discriminator handling path.


2) Out-of-bounds write (CVE-ID: CVE-2026-58096)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in LcpDecodeConfig() when processing a received endpoint discriminator option with an undersized length. A remote attacker can send a specially crafted endpoint discriminator option to execute arbitrary code.

The issue can also crash ppp(8). The vulnerable condition is triggered when the option length is below the minimum required by RFC 1717.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-58097)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a buffer overflow in mp_SetEnddisc() when handling a user-supplied PSN endpoint value through the ppp(8) command interface. A local user can supply a specially crafted PSN endpoint value to execute arbitrary code.

Exploitation requires access to the ppp(8) command interface. The issue can also crash ppp(8).


Remediation

Install update from vendor's website.

References