CVE-2026-58096: PPP Daemon RCE Vulnerability

CVE-2026-58096 Overview

CVE-2026-58096 is an out-of-bounds write vulnerability in the FreeBSD ppp(8) daemon. The flaw resides in the LcpDecodeConfig() function, which processes Link Control Protocol (LCP) configuration options during Point-to-Point Protocol (PPP) negotiation. The function fails to validate that received endpoint discriminator options meet the minimum length required by RFC 1717. Undersized options trigger a memory write beyond the intended buffer boundary. A malicious PPP peer can chain CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

Critical Impact
A remote PPP peer can trigger an out-of-bounds write in ppp(8) and potentially achieve arbitrary code execution with root privileges.

Affected Products

FreeBSD ppp(8) daemon
FreeBSD operating system distributions bundling the affected ppp implementation
Systems using FreeBSD ppp(8) to negotiate PPP sessions with untrusted peers

Discovery Timeline

2026-08-26 - CVE-2026-58096 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-58096

Vulnerability Analysis

The vulnerability is classified as an improper handling of length parameter inconsistency [CWE-130]. The LcpDecodeConfig() function parses LCP configuration options received from a PPP peer during link negotiation. Endpoint discriminator options carry a class byte followed by an address value. RFC 1717 defines a minimum option length that must accommodate the type-length-value header and class discriminator.

When ppp(8) receives an option shorter than this minimum, the function proceeds to write parsed data into memory as if a full option had been received. This produces an out-of-bounds write. Attackers who control the PPP peer can shape the malformed option payload to overwrite adjacent memory. The write primitive combined with CVE-2026-58095 raises the risk from a process crash to arbitrary code execution as root.

Root Cause

The root cause is missing length validation prior to buffer operations in LcpDecodeConfig(). The parser trusts the length field or assumes a minimum size without enforcing the RFC 1717 constraint. This class of defect appears throughout protocol decoders where the wire format is not verified against structural minimums before member access.

Attack Vector

Exploitation requires the attacker to act as a PPP peer during LCP negotiation. This can occur over dial-up links, PPPoE, PPP over serial, or tunneled PPP sessions. No prior authentication is required because the flaw sits inside the negotiation phase itself. The attacker sends a crafted LCP Configure-Request containing an undersized endpoint discriminator option, causing the vulnerable write in the target ppp(8) process.

The vulnerability manifests during protocol option decoding. See the FreeBSD Security Advisory SA-26:60 for the technical details and patch diff.

Detection Methods for CVE-2026-58096

Indicators of Compromise

Unexpected ppp(8) process crashes or core dumps referencing LcpDecodeConfig in stack traces
LCP Configure-Request packets containing endpoint discriminator options shorter than the RFC 1717 minimum
Child processes spawned by ppp(8) that are inconsistent with normal dial or tunnel workflows
Root-level shell activity originating from the ppp process tree

Detection Strategies

Inspect PPP negotiation traffic for malformed LCP options with length fields below RFC 1717 minimums
Monitor system logs for ppp daemon crashes, segmentation faults, and abnormal restarts
Alert on new outbound connections or privilege changes initiated by the ppp(8) process
Baseline expected PPP peers and flag negotiation attempts from unauthorized sources

Monitoring Recommendations

Forward FreeBSD system logs and process telemetry to a centralized analytics platform for correlation
Enable core dump collection on hosts running ppp(8) to support post-crash forensics
Track binary integrity of /usr/sbin/ppp and related libraries against vendor-provided hashes
Review authentication and process-execution events on hosts that terminate PPP sessions with external peers

How to Mitigate CVE-2026-58096

Immediate Actions Required

Apply the FreeBSD security update for ppp(8) referenced in advisory SA-26:60 without delay
Restrict ppp(8) exposure to trusted peers only and disable the service where it is not required
Audit systems for signs of prior exploitation, including unexplained ppp crashes and root process anomalies
Verify that both CVE-2026-58095 and CVE-2026-58096 are addressed, since they are exploited together

Patch Information

FreeBSD published fixes in FreeBSD Security Advisory SA-26:60. Administrators should follow the advisory's freebsd-update procedure or rebuild ppp from the corrected source tree. Reboot or restart the ppp(8) daemon after patching to ensure the updated binary is in use.

Workarounds

Disable ppp(8) on hosts that do not require PPP connectivity until patches are installed
Terminate PPP sessions only with authenticated, trusted upstream providers
Place PPP endpoints behind network controls that filter or inspect PPP encapsulation where feasible
Restrict which users and services can invoke ppp(8) to reduce the exposed attack surface

bash

# Update FreeBSD to apply the ppp(8) security patch
freebsd-update fetch
freebsd-update install

# Restart or disable the ppp service after patching
service ppp restart
# Or disable if not required:
sysrc ppp_enable="NO"
service ppp stop