Security Advisory

CVE-2026-58096

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-26 05:28:09

Last updated 2026-08-27 16:15:37

Assigner freebsd

CVSS score 8.8

State PUBLISHED

Description

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

← Browse all CVEs View on cve.org ↗