CVE-2026-58097 - Vulnerability Details - OpenCVE

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Freebsd	Freebsd

No data.

No data.

References

Link	Providers
https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc

History

Wed, 26 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 26 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Freebsd Freebsd freebsd
Vendors & Products		Freebsd Freebsd freebsd

Wed, 26 Aug 2026 05:45:00 +0000

Type	Values Removed	Values Added
Description		mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
Title		ppp(8): missing length validation in mp_SetEnddisc()
Weaknesses		CWE-122 CWE-130
References		https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc

MITRE

Status: PUBLISHED

Assigner: freebsd

Published: 2026-08-26T05:28:17.570Z

Updated: 2026-08-27T03:57:12.382Z

Reserved: 2026-06-29T01:40:17.499Z

Link: CVE-2026-58097

Vulnrichment

Updated: 2026-08-26T19:25:42.628Z

NVD

Status : Undergoing Analysis

Published: 2026-08-26T06:16:26.700

Modified: 2026-08-27T04:16:44.743

Link: CVE-2026-58097

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58097", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-06-29T01:40:17.499Z", "datePublished": "2026-08-26T05:28:17.570Z", "dateUpdated": "2026-08-27T03:57:12.382Z"}, "containers": {"cna": {"datePublic": "2026-08-25T19:45:00.000Z", "title": "ppp(8): missing length validation in mp_SetEnddisc()", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["ppp"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.1-RELEASE", "lessThan": "p3"}, {"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p13"}, {"status": "affected", "versionType": "release", "version": "14.4-RELEASE", "lessThan": "p9"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Robert Morris"}, {"lang": "en", "type": "finder", "value": "D\u00e9cio Brand\u00e3o (0xDBJ)"}, {"lang": "en", "type": "finder", "value": "Joshua Rogers"}, {"lang": "en", "type": "finder", "value": "Reo Shiseki"}], "descriptions": [{"lang": "en", "value": "mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.\n\nA local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "lang": "en", "type": "CWE"}, {"cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-26T05:28:17.570Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-58097"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T03:57:12.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-58097", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T19:25:51.709753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:25:42.628Z"}}], "cna": {"title": "ppp(8): missing length validation in mp_SetEnddisc()", "credits": [{"lang": "en", "type": "finder", "value": "Robert Morris"}, {"lang": "en", "type": "finder", "value": "D\u00e9cio Brand\u00e3o (0xDBJ)"}, {"lang": "en", "type": "finder", "value": "Joshua Rogers"}, {"lang": "en", "type": "finder", "value": "Reo Shiseki"}], "affected": [{"vendor": "FreeBSD", "modules": ["ppp"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.1-RELEASE", "lessThan": "p3", "versionType": "release"}, {"status": "affected", "version": "15.0-RELEASE", "lessThan": "p13", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p9", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-08-25T19:45:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.\n\nA local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency"}, {"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-26T05:28:17.570Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58097", "state": "PUBLISHED", "dateUpdated": "2026-08-27T03:57:12.382Z", "dateReserved": "2026-06-29T01:40:17.499Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-08-26T05:28:17.570Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}