CVE-2026-58095: PPP Daemon RCE Vulnerability

CVE-2026-58095 Overview

CVE-2026-58095 is a heap-based buffer overflow [CWE-122] in the FreeBSD ppp(8) daemon. The mp_Enddisc() function uses incorrect length calculations when formatting endpoint discriminator addresses for display. A crafted endpoint option from a remote PPP peer overflows a global result buffer.

A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root. The FreeBSD Project published advisory FreeBSD-SA-26:60.ppp describing the flaw and its remediation.

Critical Impact
A malicious PPP peer can crash the ppp(8) daemon or execute arbitrary code with root privileges on affected FreeBSD systems.

Affected Products

FreeBSD ppp(8) daemon
FreeBSD operating system versions listed in FreeBSD Security Advisory SA-26:60
Systems running ppp(8) with peer connectivity from untrusted networks

Discovery Timeline

2026-08-26 - CVE-2026-58095 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-58095

Vulnerability Analysis

The FreeBSD ppp(8) user-space daemon implements the Point-to-Point Protocol, including Multilink PPP (MP) support. Multilink PPP negotiates an endpoint discriminator option between peers to identify aggregated links.

The mp_Enddisc() helper formats received endpoint discriminator addresses into a human-readable string stored in a global result buffer. The function computes the length of the formatted output incorrectly. When a peer sends a large or malformed endpoint discriminator, the write exceeds the bounds of the destination buffer.

The overflow occurs before authentication of the underlying link is complete, so an attacker only needs to speak PPP to the target. Because ppp(8) typically runs as root, memory corruption can be leveraged for arbitrary code execution at the highest privilege level.

Root Cause

The root cause is incorrect length arithmetic in mp_Enddisc() when constructing the display representation of the endpoint discriminator. The function does not validate that the encoded address length fits within the fixed global result buffer before writing formatted bytes into it.

Attack Vector

Exploitation requires that an attacker act as a PPP peer to the target. This is reachable when ppp(8) accepts connections over a network transport such as PPPoE, PPTP, or L2TP, or when a peer negotiates Multilink PPP. The attacker sends an endpoint discriminator option that triggers the flawed length calculation and overflows the global buffer.

See the FreeBSD Security Advisory SA-26:60 for protocol-level details of the vulnerable code path.

// No verified proof-of-concept code is publicly available.
// The vulnerability is reachable by sending a crafted PPP
// endpoint discriminator option to a target running ppp(8).
// Refer to FreeBSD-SA-26:60.ppp for technical specifics.

Detection Methods for CVE-2026-58095

Indicators of Compromise

Unexpected crashes, core dumps, or restarts of the ppp(8) process on FreeBSD hosts
Kernel or syslog entries showing ppp segmentation faults following inbound peer negotiation
PPP session initiations from untrusted or unexpected peer addresses immediately preceding daemon failure
New root-owned processes or outbound connections spawned by the ppp(8) process context

Detection Strategies

Monitor process telemetry for abnormal termination of ppp(8) and correlate with recent inbound PPP negotiation events
Inspect PPP link control protocol traffic for oversized or malformed endpoint discriminator options
Alert on child processes spawned by ppp(8) that are not part of the documented configuration such as scripts in /etc/ppp/
Compare installed ppp(8) binary hashes against patched FreeBSD package versions listed in the advisory

Monitoring Recommendations

Forward ppp(8) logs and core dump events to a central logging or SIEM pipeline
Track outbound network connections from FreeBSD hosts that terminate PPP sessions
Baseline expected PPP peer addresses and alert on connections from other sources
Review file integrity for /etc/ppp/ scripts and configuration to catch tampering after exploitation

How to Mitigate CVE-2026-58095

Immediate Actions Required

Apply the FreeBSD security update referenced in FreeBSD-SA-26:60.ppp to all affected systems
Restart the ppp(8) daemon after patching to load the fixed binary
Restrict PPP peer connectivity to trusted networks and authenticated endpoints until patches are deployed
Audit systems for signs of prior exploitation, including unexpected root processes and modified PPP scripts

Patch Information

The FreeBSD Project has released fixes described in FreeBSD-SA-26:60.ppp. Administrators should install the updated base system or ppp package for their supported FreeBSD branch as documented in the advisory. Rebuild custom kernels or images that embed the vulnerable ppp(8) source. Verify the fix by confirming the installed version matches the patched revision published by the FreeBSD Project.

Workarounds

Disable ppp(8) on hosts that do not require Point-to-Point Protocol connectivity
Block inbound PPP transports such as PPPoE, PPTP, and L2TP at the network perimeter where not required
Configure ppp(8) to accept peers only from known static addresses using firewall rules
Avoid negotiating Multilink PPP with untrusted peers until the patch is applied

bash

# Example: disable and stop ppp on FreeBSD if not required
service ppp stop
sysrc ppp_enable="NO"

# Verify installed package version after patching
pkg info ppp
freebsd-version -k