CVE-2026-75883

Medium

Description

The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.

SeverityMedium

CVSS6.8

Exploit probability—

ProductPpp

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-122CWE-122

How to fix

Vendor advisories

github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35

Affected products

Product	Affected versions	Fixed in
PPP Project ppp	v ≤ 2.5.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.