CVE-2026-75883
CVE-2026-75883 · PPPD buffer overflow in PEAP response code
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
CVSS 6.8 · Medium · EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
ppp
- Versions
- ≥ 0, ≤ 2.5.0: Affected (semver)
- 2.5.4: Not affected (semver)
No fix published
ppp Debian:13
- Versions
- 2.5.2-1+1
- 2.5.2-1+1.1
- 2.5.2-1+1.2
- 2.5.2-1+2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ppp Debian:14
- Versions
- 2.5.2-1+1
- 2.5.2-1+1.1
- 2.5.2-1+1.2
- 2.5.2-1+2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:18.04:LTS
- Versions
- 1.2.8-1
- 1.2.8-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:20.04:LTS
- Versions
- 1.2.10-1
- 1.2.14-1
- 1.2.16-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:22.04:LTS
- Versions
- 1.2.18-1build1
- 1.20.0-1
- 1.20.0-1build1
- 1.20.0-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:24.04:LTS
- Versions
- 1.20.8-1
- 1.20.10-1
- 1.20.12-1
- 1.20.12-1build1
- 1.20.12-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:26.10
- Versions
- 1.52.0-2
- 1.52.2-1
- 1.52.4-1
- 1.52.4-1build1
- 1.52.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
network-manager-l2tp Ubuntu:26.04:LTS
- Versions
- 1.20.20-2
- 1.52.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published