Out-of-bounds write in PPP - CVE-2026-75883
Published: August 21, 2026 / Updated: September 19, 2026
Vulnerability identifier: #VU144553
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75883
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to out-of-bounds write in the peap_response() code path when formatting a response to a PEAP Request packet. A remote attacker can send a PEAP authentication request that causes a TLS record to be copied into a fixed global buffer without sufficient bounds checking to corrupt memory.
The pppd process must be configured to agree to PEAP authentication, such as when the ca option or the capath option is supplied. Each pppd instance communicates with a single remote PPP peer, so a crash denies service only to that peer.
Affected software
PPP
openEuler
ppp
ppp-debuginfo
ppp-debugsource
ppp-devel
ppp-help
openEuler
ppp
ppp-debuginfo
ppp-debugsource
ppp-devel
ppp-help
How to mitigate CVE-2026-75883
Install update from vendor's website.
PPP - update to 2.5.4
ppp - update to 2.5.0-6
ppp-debuginfo - update to 2.5.0-6
ppp-debugsource - update to 2.5.0-6
ppp-devel - update to 2.5.0-6
ppp-help - update to 2.5.0-6
ppp - update to 2.5.0-6
ppp-debuginfo - update to 2.5.0-6
ppp-debugsource - update to 2.5.0-6
ppp-devel - update to 2.5.0-6
ppp-help - update to 2.5.0-6