CVE-2026-58096 PUBLISHED

ppp(8): missing length validation in LcpDecodeConfig()

Assigner: freebsd
Reserved: 29.06.2026 Published: 26.08.2026 Updated: 26.08.2026

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write.

A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

Product Status

Vendor FreeBSD
Product FreeBSD
Versions Default: unknown
  • affected from 15.1-RELEASE to p3 (excl.)
  • affected from 15.0-RELEASE to p13 (excl.)
  • affected from 14.4-RELEASE to p9 (excl.)

Credits

  • Robert Morris finder
  • Décio Brandão (0xDBJ) finder
  • Joshua Rogers finder
  • Reo Shiseki finder

References

Problem Types

  • CWE-130: Improper Handling of Length Parameter Inconsistency CWE
  • CWE-787: Out-of-bounds Write CWE