CVE-2026-58096CWE-130CWE-787

CVE-2026-58096

High · published August 26, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write.

A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weaknesses
CWE-130 · Improper Handling of Length Parameter Inconsistency; CWE-787 · Out-of-bounds Write
Published
2026-08-26T10:16Z
Affected products (22)
ProductVersionsFixed in
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
References (1)
https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc · [email protected]
EPSS history
Timeline
  • 27 AUG 06:37Z
    EPSS moved — → 0%
    epss
  • 26 AUG 05:28Z
    ppp(8): missing length validation in LcpDecodeConfig()
    cvelistv5