CVE-2026-58097
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
Risk Assessment
A local attacker could gain root privileges, leading to full system compromise.
Recommendation
Apply patches provided by the system or ppp software vendor. Restrict access to the ppp(8) command interface to trusted users only.
Other vulnerabilities in ppp
See all- CVE-2026-102726Medium
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read. This vulnerability can lead to service crash or information leakage.
- CVE-2026-58096High
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58095High
The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Original NVD description (English source)
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS