CVE-2026-58096
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
Risk Assessment
An attacker can remotely crash the PPP service or gain root privileges, leading to full host compromise.
Recommendation
Apply vendor patches for ppp(8) and upgrade to a fixed version.
Original NVD description (English source)
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.