CVE-2026-102726
MediumCVSS 6.0Summary
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read. This vulnerability can lead to service crash or information leakage.
Risk Assessment
Risk of denial of service (DoS) and potential memory data leakage.
Recommendation
Update the PPP implementation to a patched version and restrict network access for untrusted clients.
Other vulnerabilities in PPP
See all- CVE-2026-58097High
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58096High
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58095High
The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Original NVD description (English source)
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
Vulnerability data from NVD (NIST) · CISA KEV · EPSS