mp_SetEnddisc() copies a user-supplied PSN endpoint value without validating its length, which can cause an uncontrolled buffer overflow when invoked through the ppp(8) command interface. The overflow may corrupt memory, leading to a denial‑of‑service crash of ppp(8) or, if the attacker can control the overflowed data, to execution of arbitrary code with root privileges. The vulnerability is a heap‑based buffer overflow (CWE‑122) and a string length error (CWE‑130).

Only the FreeBSD operating system is affected; the vulnerability resides in the kernel component handling PPP configuration via the mp_SetEnddisc routine. No specific versions are listed in the advisory, so all releases that include the unpatched mp_SetEnddisc implementation are potentially vulnerable until a patch is applied.

The EPSS score is not available and the vulnerability is not included in CISA KEV, but the lack of input validation is a critical flaw. Because exploitation requires local access to the ppp(8) command, the attacker must be able to run the command, usually as a privileged or root user. Nevertheless, local users on the system can trigger a crash or hijack the process, which may allow privilege escalation to root on the affected machine.