CVE-2026-58096

The record

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

Affected packages

Related vulnerabilities

• CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged… CWE-130
• CVE-2026-5706 In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger… CWE-130
• CVE-2026-71402 An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. CWE-130
• CVE-2026-81575 If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts… CWE-130
• CVE-2026-58097 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation… CWE-130
• CVE-2026-14587 Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way… CWE-130
• CVE-2026-67292 FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway… CWE-130
• CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the… CWE-130