CVE-2026-58096

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58095

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

EUVD-2026-66248

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097

The ppp(8) utility in FreeBSD contains a buffer overflow vulnerability in the mp_SetEnddisc() function. The flaw exists because the software copies a user-supplied PSN endpoint value without performing proper length validation via the ppp(8) command interface. A local user with access to this int...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58096

The ppp(8) utility in the FreeBSD operating system kernel contains a memory safety vulnerability in the LcpDecodeConfig() function. The flaw exists because the function fails to validate the length of received endpoint discriminator options against the minimum requirements specified in RFC 1717 ,...

EUVD-2026-66247

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095

The FreeBSD operating system is vulnerable to a buffer overflow in the ppp(8) utility due to incorrect length calculations within the mp_Enddisc() function. When formatting endpoint discriminator addresses for display, a received endpoint option can overflow a global result buffer. A malicious PP...

PT-2026-81939

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58096: Improper Handling of Length Parameter Inconsistency

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58097: Improper Handling of Length Parameter Inconsistency

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095: Heap-based Buffer Overflow

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

FreeBSD -- Multiple vulnerabilities in ppp(8)

Problem Description: ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result...