Description
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer.

A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Published: 2026-08-26
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The bug in mp_Enddisc() causes an incorrect length calculation when formatting endpoint discriminator addresses for display, which overflows a global result buffer. This overflow can crash the ppp(8) process or, if exploited correctly, allow an attacker to execute arbitrary code with root privileges. The flaw is a classic buffer overflow (CWE‑122) that can compromise confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects FreeBSD systems that use the ppp(8) implementation containing mp_Enddisc(). Specific product is FreeBSD; no version information is listed, so all releases affected by the advisory should be considered vulnerable until a patched release is applied.

Risk and Exploitability

The attack vector is a malicious PPP peer that sends a crafted endpoint option. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, but a CVSS score of 8.8 indicates high severity. The flaw can lead to arbitrary code execution with root privileges and remains exploitable from a remote PPP session without additional authentication.

Generated by OpenCVE AI on August 28, 2026 at 08:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a FreeBSD release that contains the patch for the mp_Enddisc() overflow as described in the FreeBSD advisory.
  • If immediate upgrade is not feasible, disable PPP on untrusted interfaces or limit PPP via firewall rules until the patch is installed.
  • Implement network segmentation or access controls to restrict PPP connections to trusted peers only, reducing the attack surface until a permanent fix is applied.

Generated by OpenCVE AI on August 28, 2026 at 08:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.4:p8:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:*

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 26 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Freebsd
Freebsd freebsd
Vendors & Products Freebsd
Freebsd freebsd

Wed, 26 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Title ppp(8): incorrect length calculation in mp_Enddisc()
Weaknesses CWE-122
References

Subscriptions

Freebsd Freebsd
cve-icon MITRE

Status: PUBLISHED

Assigner: freebsd

Published:

Updated: 2026-08-27T16:16:04.777Z

Reserved: 2026-06-29T01:40:17.499Z

Link: CVE-2026-58095

cve-icon Vulnrichment

Updated: 2026-08-26T15:28:24.759Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-26T06:16:26.460

Modified: 2026-09-10T15:39:29.340

Link: CVE-2026-58095

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T08:15:06Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow