LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

CVE-2026-58096 affects the LcpDecodeConfig() function in FreeBSD's ppp(8) daemon, which failed to validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options trigger an out-of-bounds write, potentially leading to memory corruption. A malicious PPP peer can exploit this vulnerability in conjunction with CVE-2026-58095 to crash the ppp(8) process or execute arbitrary code with root privileges. The vulnerability is present in the FreeBSD operating system's PPP implementation. No authentication beyond PPP peering is required to trigger the flaw. The impact is critical given the potential for remote code execution as root. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing both CVEs.