CVE search · CVE-2026-58097

CVE-2026-58097

high 7.8

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2026-08-26
Last changed: 2026-09-10
Source: secteam@freebsd.org
Weakness: CWE-122, CWE-130

Severity

Version	Score	Vector	Source
CVSS 3.1	high 7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

freebsd · freebsd

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.ascVendor Advisory

CVE-2026-58097

Details

Severity

Affected products

References