FreeBSD ppp CVE-2026-58097

Exploitation requires that the attacker hold a local account on the FreeBSD system AND have been specifically granted access to the ppp(8) command interface - access that is controlled via ppp.conf allow directives and typically restricted to network administrators. The CVSS PR:L metric confirms that no administrative or root privilege is needed to trigger the flaw, only this ppp-interface-level access. Systems that do not run ppp(8), have it disabled, or where no unprivileged users have been granted command interface access are not exploitable by non-root actors. Exploitation is further bounded to the three unpatched release lines: FreeBSD 15.1-RELEASE before p3, 14.4-RELEASE before p9, and 15.0-RELEASE before p13. The CVSS AC:L confirms no race condition or special timing is needed once interface access is present.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes the local, low-complexity, low-privilege nature of the flaw with full CIA impact. In practice, real-world exploitation risk is materially lower than the score implies. The EPSS score of 0.27% (19th percentile) signals that the broader threat-intelligence community sees limited near-term exploitation likelihood, and the CVE is not listed in CISA KEV - confirmed active exploitation is absent. No public proof-of-concept code has been identified. The attack is further constrained by the requirement for local account access plus specific access to the ppp(8) command interface, which is not universally granted on multi-user systems. However, the impact ceiling remains high: ppp(8) runs as root, so a successful exploit yields complete host takeover with no privilege escalation step required beyond triggering the overflow. The availability of vendor-released patches across all affected branches makes remediation the clear priority over compensating controls, and no CVSS-vs-description inconsistency is observed - the local attack vector is confirmed both by description and vector.

A local user granted access to the ppp(8) command interface issues a crafted command that passes an oversized PSN endpoint discriminator value to the mp_SetEnddisc() function, which copies it into a fixed-size buffer without bounds checking, corrupting adjacent memory. Depending on memory layout and stack protections in place, the attacker either crashes ppp(8) (denial of service, disrupting PPP connectivity) or manipulates the overflow to redirect execution flow and gain a root shell on the host. No public proof-of-concept code has been identified at time of analysis.