CVE-2026-58097 PUBLISHED

ppp(8): missing length validation in mp_SetEnddisc()

Assigner: freebsd
Reserved: 29.06.2026 Published: 26.08.2026 Updated: 26.08.2026

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.

A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

Product Status

Vendor FreeBSD
Product FreeBSD
Versions Default: unknown
  • affected from 15.1-RELEASE to p3 (excl.)
  • affected from 15.0-RELEASE to p13 (excl.)
  • affected from 14.4-RELEASE to p9 (excl.)

Credits

  • Robert Morris finder
  • Décio Brandão (0xDBJ) finder
  • Joshua Rogers finder
  • Reo Shiseki finder

References

Problem Types

  • CWE-130: Improper Handling of Length Parameter Inconsistency CWE
  • CWE-122: Heap-based Buffer Overflow CWE