Buffer Overflow Vulnerability in PEAP Implementation of pppd by the PPP Project

CVE-2026-75883

What is CVE-2026-75883?

A vulnerability exists in the pppd code where the response formatting for a PEAP Request packet does not verify buffer limits before copying a full TLS record of up to 16384 bytes into a fixed global buffer. This oversight can lead to corruption of global static data, causing unpredictable behavior, potential crashes, or other significant functional disruptions. An attacker can exploit this flaw by sending a specially crafted PEAP authentication request, thus compromising the stability of the pppd process.

References