CVE-2026-75883 in ppp
Summary
by MITRE • 09/18/2026
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Point-to-Point Protocol daemon (pppd) represents a critical buffer overflow flaw within the implementation of Protected Extensible Authentication Protocol over TLS (PEAP). Specifically, the issue resides in the peap_response function, which is responsible for formatting and sending responses to PEAP request packets. When pppd operates as an authenticator or client connecting to a server that mandates PEAP authentication, it must process incoming TLS records from the peer. The code incorrectly copies entire TLS records, which can be as large as 16384 bytes, directly into a fixed-size global buffer named outpacket_buf. This operation is performed without verifying whether the destination buffer has sufficient capacity to hold the incoming data, nor does it implement any mechanism for outgoing PEAP fragmentation that would split oversized payloads into manageable chunks suitable for transmission.
From a technical perspective, this flaw constitutes an improper limit on array index or pointer arithmetic, leading to a classic heap or stack-based buffer overflow depending on where outpacket_buf is allocated within the process memory space. Because outpacket_buf is defined as a global static variable, overflowing it corrupts adjacent global data structures in memory. This corruption can overwrite critical program state variables, function pointers, or other control data located immediately after the buffer in memory layout. The absence of bounds checking means that any PEAP response packet containing a TLS record exceeding the remaining space in outpacket_buf will write beyond its allocated boundaries, resulting in undefined behavior within the pppd process.
The operational impact of this vulnerability is severe and multifaceted. In most scenarios, the immediate consequence is the corruption of global static data, which typically leads to incorrect protocol behavior or a complete crash of the pppd daemon. For network administrators relying on PPP for remote access or broadband connections, such crashes can result in service denial, disrupting connectivity for users authenticated through this mechanism. Furthermore, if an attacker can carefully craft the TLS record payload and control what data is overwritten in memory adjacent to outpacket_buf, they may potentially achieve arbitrary code execution. This would allow full compromise of the host system running pppd, granting the attacker elevated privileges or access to sensitive network resources protected by that authentication gateway.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write. In terms of attack vectors, it relates to the ATT&CK technique T1190 Exploit Public-Facing Application, where an attacker targets a service exposed to untrusted networks. The lack of fragmentation support also highlights a design flaw in handling variable-length protocol data units, which is often categorized under CWE-20 Improper Input Validation.
Mitigation strategies must address both the immediate code defect and broader architectural issues. The primary remediation involves modifying the peap_response function to implement strict bounds checking before copying TLS records into outpacket_buf. If a record exceeds the available space in the buffer, the implementation should either truncate the data safely or, more appropriately for PEAP compliance, fragment the response into multiple smaller packets that fit within the buffer limits. Additionally, developers should consider replacing fixed-size global buffers with dynamically allocated memory structures that can grow as needed, thereby eliminating the risk of overwriting adjacent static variables. Regular security audits and fuzzing tests targeting PPP authentication modules are recommended to detect similar issues in other protocol handlers. System administrators who cannot immediately patch their systems may need to restrict PEAP usage or monitor for unusual pppd process terminations indicative of exploitation attempts.