CVE-2026-58096
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
Risk Assessment
An attacker can remotely crash the PPP service or gain root privileges, leading to full host compromise.
Recommendation
Apply vendor patches for ppp(8) and upgrade to a fixed version.
Other vulnerabilities in ppp
See all- CVE-2026-102726Medium
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read. This vulnerability can lead to service crash or information leakage.
- CVE-2026-58097High
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58095High
The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Original NVD description (English source)
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS