Buffer Overflow Vulnerability in FreeBSD PPP Command Interface
CVE-2026-58097

7.8HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
26 August 2026

What is CVE-2026-58097?

The vulnerability arises in the mp_SetEnddisc() function, which improperly handles user-supplied PSN endpoint values, leading to a buffer overflow. This flaw can be exploited by local users who have access to the PPP command interface, potentially allowing them to crash the service or execute arbitrary code with root privileges. System administrators should ensure they apply the latest patches and monitor their environments to mitigate the associated risks.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

FreeBSD 14.4-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:60....
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert Morris
DĂ©cio BrandĂŁo (0xDBJ)
Joshua Rogers
Reo Shiseki
.