CVE-2026-75883
Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
- Record
CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-120
- Updated
- 2026-11-04
EUVDEUVD-2026-82994
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
- Record
EUVD-2026-82994- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
NVD
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
- Record
CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-120
- Updated
- 2026-11-04
OSVBELL-CVE-2026-75883
- Record
BELL-CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSV
PPPD buffer overflow in PEAP response code
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
- Record
CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-75883
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
- Record
DEBIAN-CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2026-4116
ppp security update
The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link. At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP. The Linux port of this package also has support for IPX.
Security Fix(es):
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.(CVE-2026-75883)
- Record
OESA-2026-4116- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4117
ppp security update
The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link. At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP. The Linux port of this package also has support for IPX.
Security Fix(es):
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.(CVE-2026-75883)
- Record
OESA-2026-4117- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4118
ppp security update
The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link. At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP. The Linux port of this package also has support for IPX.
Security Fix(es):
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.(CVE-2026-75883)
- Record
OESA-2026-4118- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-75883
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
- Record
UBUNTU-CVE-2026-75883- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVAZL-103302 No score
CVE-2026-75883 affecting package ppp 2.5.0-1
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
- Record
AZL-103302- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11802-1 No score
NetworkManager-applet-l2tp-1.52.6-1.1 on GA media
These are all security issues fixed in the NetworkManager-applet-l2tp-1.52.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11802-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pppAzure Linux:3 |
through 2.5.0-1 | None known |
pppAlpaquita:25 |
2.5.2-r0 up to 2.5.4-r0 | 2.5.4-r0 |
pppAlpaquita:stream |
2.5.0-r2 up to 2.5.4-r0 | 2.5.4-r0 |
pppDebian:13 |
All versions, plus listed versions 2.5.2-1+12.5.2-1+1.12.5.2-1+1.22.5.2-1+2 |
None known |
pppDebian:14 |
All versions, plus listed versions 2.5.2-1+12.5.2-1+1.12.5.2-1+1.22.5.2-1+2 |
None known |
pppopenEuler:24.03-LTS-SP3 |
before 2.5.0-6.oe2403sp3 | 2.5.0-6.oe2403sp3 |
pppopenEuler:24.03-LTS-SP4 |
before 2.5.0-6.oe2403sp4 | 2.5.0-6.oe2403sp4 |
pppopenEuler:24.03-LTS-SP1 |
before 2.5.0-6.oe2403sp1 | 2.5.0-6.oe2403sp1 |
network-manager-l2tpUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.8-11.2.8-2build1 |
None known |
network-manager-l2tpUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.10-11.2.14-11.2.16-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
network-manager-l2tpUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.18-1build11.20.0-11.20.0-1build11.20.0-1build2 |
None known |
network-manager-l2tpUbuntu:24.04:LTS |
All versions, plus listed versions 1.20.8-11.20.10-11.20.12-11.20.12-1build11.20.12-1build2 |
None known |
network-manager-l2tpUbuntu:26.10 |
All versions, plus listed versions 1.52.0-21.52.2-11.52.4-11.52.4-1build11.52.6-1 |
None known |
network-manager-l2tpUbuntu:26.04:LTS |
All versions, plus listed versions 1.20.20-21.52.0-2 |
None known |
NetworkManager-l2tpopenSUSE:Tumbleweed |
before 1.52.6-1.1 | 1.52.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | EUVD | |
| cwes, description, facts, products, references, title | CVE List | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75883 is a medium vulnerability (CVSS 6.8) in Red Hat Enterprise Linux 10, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in ppp 2.5.4-r0.
References
access.redhat.com/security/cve/CVE-2026-75883
bugzilla.redhat.com/show_bug.cgi?id=2538346
github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
nvd.nist.gov/vuln/detail/CVE-2026-75883
docs.bell-sw.com/security/cves/CVE-2026-75883
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2026-75883
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4116
ubuntu.com/security/CVE-2026-75883
cve.org/CVERecord?id=CVE-2026-75883
suse.com/security/cve/CVE-2026-75131