Out-of-bounds write in PPP - CVE-2026-75883
Published: August 21, 2026
Vulnerability identifier: #VU144553
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75883
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to out-of-bounds write in the peap_response() code path when formatting a response to a PEAP Request packet. A remote attacker can send a PEAP authentication request that causes a TLS record to be copied into a fixed global buffer without sufficient bounds checking to corrupt memory.
The pppd process must be configured to agree to PEAP authentication, such as when the ca option or the capath option is supplied. Each pppd instance communicates with a single remote PPP peer, so a crash denies service only to that peer.
Affected software
PPP
How to mitigate CVE-2026-75883
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.