CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

FreeBSD ppp(8) (a setuid-root user-space PPP implementation requiring "network" group membership) contains a memory safety error in mp_Enddisc() , which used incorrect length calculations when formatting endpoint discriminator addresses for display. A malicious PPP peer can send a crafted endpoin...