LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

CVE-2026-58096 is a vulnerability in the FreeBSD ppp(8) daemon where LcpDecodeConfig() fails to validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options trigger an out-of-bounds write, potentially allowing memory corruption. A malicious PPP peer can exploit this vulnerability in conjunction with CVE-2026-58095 to crash the ppp(8) process or execute arbitrary code with root privileges. The vulnerability resides in the PPP protocol handling code of FreeBSD. The attack vector requires a malicious peer on a PPP connection, limiting but not eliminating the attack surface. Successful exploitation could lead to full system compromise given the root-level execution potential. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing this issue.