LcpDecodeConfig() in FreeBSD’s ppp(8) did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717, allowing an attacker to send undersized options that trigger an out‑of‑bounds write. This defect can crash the ppp process or, as documented, enable execution of arbitrary code with root privileges. The weakness is categorized as CWE‑130 and CWE‑787.

FreeBSD systems that run the unpatched version of ppp(8) are affected. The advisory does not list specific release numbers, so any FreeBSD installation that includes the vulnerable LcpDecodeConfig() routine is potentially at risk. Services that use PPP for network connectivity should assume the possibility of exploitation.

No EPSS score is available and the vulnerability is not yet in CISA’s KEV list, but the advisory labels it as high severity. Exploitation requires a malicious PPP peer capable of sending crafted options; this peer could be remote if the PPP interface is exposed to external hosts. An attacker could crash the ppp daemon or gain root privileges through the out‑of‑bounds write, representing a severe threat to confidentiality, integrity, and availability.