Buffer Overflow Vulnerability in PPP by FreeBSD
CVE-2026-58095

8.8HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
26 August 2026

What is CVE-2026-58095?

A vulnerability exists in the FreeBSD Point-to-Point Protocol (PPP) where the mp_Enddisc() function improperly calculates the length of endpoint discriminator addresses. This flaw can lead to a buffer overflow, enabling a malicious PPP peer to crash the ppp(8) process or potentially execute arbitrary code with root privileges, posing significant security risks.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

FreeBSD 14.4-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:60....
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert Morris
DĂ©cio BrandĂŁo (0xDBJ)
Joshua Rogers
Reo Shiseki
.