CVE-2026-58096
Last modified
CVE-2026-58096 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Freebsd | Freebsd | 14.4 | P1 |
| Freebsd | Freebsd | 15.0 | P1 |
| Freebsd | Freebsd | 15.1 | P1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-58096?
How severe is CVE-2026-58096?
How do I fix CVE-2026-58096?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-58090The SOCK_STREAM receive path in the unix socket implementati…7.8
- CVE-2026-58091The implementation of this ioctl attempts to acquire locks o…7.8
- CVE-2026-58092In FreeBSD 15.0, the kernel structure used to represent user…8.1
- CVE-2026-58093The TIOCSCTTY ioctl handler drops the tty lock in order to a…7
- CVE-2026-58094The FIOSSHMLPGCNF ioctl(2) operation configures the page siz…7.8
- CVE-2026-58095mp_Enddisc() used incorrect length calculations when formatt…8.8
- CVE-2026-58097mp_SetEnddisc() copied a user-supplied PSN endpoint value wi…7.8
- CVE-2026-5810A flaw has been found in SourceCodester Sales and Inventory …3.5
- CVE-2026-58101Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow de…7.5
- CVE-2026-58102Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a …9.1
- CVE-2026-58106CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-…2
- CVE-2026-58107CodeChecker's massStoreRun processing path performs one-shot…5.5
Are you affected by CVE-2026-58096?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST