Reo Shiseki

**Name of the Vulnerable Software and Affected Versions** ppp (affected versions not specified) **Description** The `mp Enddisc()` function uses incorrect length calculations when formatting endpoint discriminator addresses for display. This flaw allows a received endpoint option to overflow a global result buffer, which could enable a malicious PPP peer to crash the `ppp(8)` process or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** An issue exists where the `mp SetEnddisc()` function copies a user-supplied PSN endpoint value without performing length validation. This flaw allows a buffer overflow via the ppp(8) command interface, which a local user can exploit to crash ppp(8) or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pfSense Plus versions prior to 26.07 **Description** The wg(4) driver fails to verify if the MAC verification step succeeded after receiving a decryption result from OCF. This allows the driver to silently accept packets containing an invalid Poly1305 authentication tag. A remote attacker capable of sending UDP packets to a WireGuard endpoint and guessing the receiver's replay window bounds can inject forged or modified transport data packets into the tunnel. Additionally, an attacker intercepting packets bound for a FreeBSD host can modify the ciphertext and authenticated data without being detected by the receiver. **Recommendations** Update pfSense Plus to version 26.07.