PPPD buffer overflow in PEAP response code
Published Sep 18, 2026
6.8
MEDIUMCVSS 3.1
EPSS 0.18%
Description
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
Affected products
-
Affected
- ≥ 0, ≤ 2.5.0
Unaffected
- 2.5.4
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| PPP Project | Ppp | unknown | Affected
Unaffected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82994 Advisory
- https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35 vendor-advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82994 | Advisory | |
| https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35 | vendor-advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data