CVE-2026-58095 in ppp
Summary
by MITRE • 08/26/2026
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer.
A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability resides within the mp_Enddisc function in the Point-to-Point Protocol implementation of OpenBSD, specifically affecting versions prior to 6.9 where this issue was resolved. This component is responsible for handling endpoint discriminator options during PPP session establishment and maintenance. The core technical flaw involves an incorrect calculation of buffer lengths when formatting these addresses for display purposes. Instead of accurately determining the size required for the output string based on the input data, the function miscalculates the space needed, leading to a classic heap-based or stack-based buffer overflow condition depending on the specific memory allocation strategy employed by the underlying system libraries at that time.
When a malicious PPP peer sends an endpoint option with crafted length fields or content, it triggers this flawed calculation logic. The resulting write operation exceeds the boundaries of the global result buffer allocated for storing the formatted discriminator address. This out-of-bounds write corrupts adjacent memory structures, which can lead to immediate process termination if the corruption affects critical control data such as return addresses or exception handlers. In more sophisticated exploitation scenarios, an attacker could leverage this memory corruption to overwrite function pointers or other executable code segments within the privileged ppp daemon context.
The operational impact of this vulnerability is severe due to the privilege level at which the PPP service typically operates. The ppp(8) process often runs with root privileges to manage network interfaces and routing tables. Consequently, a successful exploitation allows an attacker to achieve arbitrary code execution as the superuser on the affected system. This grants complete control over the host, enabling actions such as data exfiltration, persistence installation, lateral movement within the network, or denial of service by crashing critical infrastructure services. The attack vector is remote if PPP connections are accepted from untrusted networks, making this a high-risk vulnerability for systems exposed to external dial-up or VPN connections using PPP protocols.
From a classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and potentially CWE-787 Out-of-bounds Write if the overflow results in writing beyond allocated memory boundaries. In terms of adversary behavior, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter or T1068 Exploitation for Privilege Escalation, as the ultimate goal is often gaining elevated access through remote code execution vulnerabilities.
Mitigation strategies primarily involve applying vendor-provided patches that correct the length calculation logic within mp_Enddisc to ensure strict bounds checking before any memory write operations occur. System administrators should also consider disabling PPP services if they are not strictly required for network connectivity, thereby reducing the attack surface. For environments where PPP must remain active, implementing strict input validation at the protocol level and restricting access to PPP interfaces via firewall rules can provide additional layers of defense against exploitation attempts from untrusted peers.