CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

CVE-2026-58096 is an out-of-bounds write in FreeBSD's ppp(8) (a setuid-root user-space PPP implementation). The LcpDecodeConfig() function failed to validate the length of received multilink endpoint discriminator options against the minimum required by RFC 1717 , allowing undersized options to t...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...