# CVE-2026-58095: FreeBSD ppp buffer overflow in endpoint discriminator handling

Source: https://junglewise.ai/threats/cve-2026-58095-freebsd-ppp-buffer-overflow-in-endpoint-discriminator-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-58095 · Severity: high · CVSS 8.8 · Published 2026-08-26

FreeBSD's ppp(8) is a network utility for establishing Point-to-Point Protocol connections, commonly used for dial-up and serial links. A malicious remote peer can send specially crafted endpoint discriminator options that cause a buffer overflow in the ppp daemon, crashing the service or potentially executing arbitrary code with root privileges.

Technologies: [Freebsd](https://junglewise.ai/threats/technologies/freebsd). Vendors: [Freebsd](https://junglewise.ai/threats/vendors/freebsd).

## Quick answers

**Is CVE-2026-58095 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58095 being exploited in the wild.

**How severe is CVE-2026-58095?** High severity, with a CVSS score of 8.8, published 26 August 2026.

**Which products and versions are affected?** Freebsd All supported versions (14.4 before 2026-08-25, 15.0 before 2026-08-25, 15.1 before 2026-08-25).

**Is there a fix for CVE-2026-58095?** A patch was published on 2026-08-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58095 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-58095?** Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mp_Enddisc() function in ppp(8) uses incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. The vulnerability is a classic buffer overflow triggered via network input from a malicious PPP peer. Since ppp(8) runs as setuid root (though restricted to the "network" group), successful exploitation grants root code execution. No user authentication or interaction is required; a remote attacker needs only to establish a PPP connection. Patches are available for all supported FreeBSD versions (14.4, 15.0, 15.1).

## Affected products

- FreeBSD FreeBSD All supported versions (14.4 before 2026-08-25, 15.0 before 2026-08-25, 15.1 before 2026-08-25)

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched

## References

- [https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc](https://security.freebsd.org/advisories/FreeBSD-SA-26:60.ppp.asc)

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD RACK stack buffer overflow in tcp_rack](https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a)