MEDIUM 6.8 NVD

CVE-2026-75883

The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buff

The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.

Remediation

$ sudo apt install --only-upgrade network-manager-l2tp

References

https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35

Published: 2026-09-18 · Source: NVD · Feed updated: 2026-09-18

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-09-18 via NVD. A remediation command is available below.

vulnfeed aggregates 14649 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.