mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

CVE-2026-58095 is a critical vulnerability in FreeBSD's ppp(8) daemon affecting the mp_Enddisc() function. The function uses incorrect length calculations when formatting endpoint discriminator addresses for display purposes. This flaw allows a received endpoint option from a malicious PPP peer to overflow a global result buffer. Exploitation can result in a crash of the ppp(8) process or potentially allow arbitrary code execution with root privileges. The vulnerability is remotely triggerable by any malicious PPP peer without authentication requirements. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing this issue. The high criticality stems from the potential for unauthenticated remote code execution as root.