CVE-2026-58095
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Risk Assessment
Similar to CVE-2026-58096, an attacker can remotely crash the service or gain root privileges, posing a serious threat to system integrity.
Recommendation
Install ppp(8) updates that include the fix for this vulnerability.
Other vulnerabilities in ppp
See all- CVE-2026-102726Medium
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read. This vulnerability can lead to service crash or information leakage.
- CVE-2026-58097High
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58096High
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
Original NVD description (English source)
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS