CVE-2026-75883

A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.

This vulnerability is rated as Moderate impact because successful exploitation requires an adjacent peer to manipulate authentication exchanges against an active client connection, rather than allowing unauthenticated remote attacks against a listening service. In typical Red Hat Enterprise Linux deployments, the Point-to-Point Protocol daemon (pppd) is not enabled by default and is only invoked when specific dial-up, broadband, or VPN links are configured. Systems remain unaffected unless they actively establish a connection to an untrusted or compromised server that demands PEAP authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.