LcpDecodeConfig() in FreeBSD’s ppp(8) fails to validate the length of received endpoint discriminator options against the minimum required by RFC 1717, which allows an attacker to send undersized options that trigger an out‑of‑bounds write. This flaw is classified as CWE‑130 and CWE‑787. On a vulnerable system the write can corrupt memory, causing the ppp process to crash or, as documented, to execute arbitrary code with root privileges.

FreeBSD systems that include the unpatched LcpDecodeConfig() routine are affected. The advisory does not specify release numbers, so any FreeBSD installation with the vulnerable ppp(8) code is at risk. Network services that use PPP for connectivity should assume that if a PPP interface receives traffic from an untrusted peer, exploitation is possible.

The CVSS score of 8.8 and an EPSS score of less than 1% indicate a severe vulnerability with a low probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is a malicious PPP peer that sends crafted options; this peer could be remote if the PPP interface is exposed to external hosts. An attacker can cause a denial of service by crashing the ppp daemon or, through the out‑of‑bounds write, gain root access, thereby compromising confidentiality, integrity, and availability.