Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-58096Root RCE in PPP daemon (ppp8)

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

View on NVD

Analysis

A critical vulnerability in the PPP daemon (ppp8) allows a malicious peer to execute arbitrary code with root privileges via crafted LCP configuration options. This impacts any Linux or BSD system utilizing PPP for networking, including certain VPN and point-to-point configurations.

Relevant roles

LinuxciberseguridadBackendC

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-130CWE-787

EPSS

Probability of exploitation (next 30 days): 0.0029 (0.3%)
Percentile: 20.5%
EPSS: 2026-08-26

Technical description

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

Published: 8/26/2026, 6:16:26 AM
Last modified: 8/27/2026, 4:16:44 AM

References

HomeEventsBlogResourcesCoursesTeam