CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

FreeBSD ppp(8) is a user-space Point-to-Point Protocol implementation installed setuid root . This vulnerability resides in mp_SetEnddisc() , a function handling Multilink PPP endpoint discriminators. The root cause is that a user-supplied PSN endpoint value is copied into a buffer without length...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

CVE-2026-58096 is an out-of-bounds write in FreeBSD's ppp(8) (a setuid-root user-space PPP implementation). The LcpDecodeConfig() function failed to validate the length of received multilink endpoint discriminator options against the minimum required by RFC 1717 , allowing undersized options to t...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

FreeBSD ppp(8) (a setuid-root user-space PPP implementation requiring "network" group membership) contains a memory safety error in mp_Enddisc() , which used incorrect length calculations when formatting endpoint discriminator addresses for display. A malicious PPP peer can send a crafted endpoin...

FreeBSD -- Multiple vulnerabilities in ppp(8)

Problem Description: ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result...