CVE-2026-58097
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
Risk Assessment
A local attacker could gain root privileges, leading to full system compromise.
Recommendation
Apply patches provided by the system or ppp software vendor. Restrict access to the ppp(8) command interface to trusted users only.
Other vulnerabilities in ppp
See all- CVE-2026-58096High
The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.
- CVE-2026-58095High
The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Original NVD description (English source)
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.