A critical heap-based buffer overflow in FreeBSD allows unauthenticated remote attackers to achieve full system compromise via malicious PPP peer communication.

The mp_Enddisc function performs incorrect length calculations when processing endpoint discriminator addresses, resulting in a heap-based buffer overflow. This flaw can be triggered by an unauthenticated remote attacker sending a specially crafted PPP packet to the ppp(8) utility.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker root-level access, leading to complete system compromise, unauthorized data exfiltration, and potential lateral movement within the network. The ability for an unauthenticated remote attacker to execute arbitrary code with the highest level of privilege poses an extreme risk to infrastructure integrity and data confidentiality.

Immediate Action: Apply the vendor-supplied security patch immediately by updating the affected FreeBSD releases to the specified versions (15.1-RELEASE-p3, 15.0-RELEASE-p13, or 14.4-RELEASE-p9) as detailed in the FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unusual ppp(8) activity or process crashes that might indicate attempted exploitation of this buffer overflow.

Compensating Controls: Restrict network access to the affected ppp(8) services using host-based firewalls or network segmentation to prevent external access from untrusted sources.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the potential for remote code execution with root privileges, this vulnerability must be treated with the highest priority. Administrators should verify their current FreeBSD release versions and apply the recommended patches immediately to mitigate the risk of full system takeover.