CVE-2026-127029: Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
A flaw was found in freeradius's EAP-SIM module. The server copies the client-supplied EAP identity into an internal key-derivation structure without bounding its length against the destination field, and the resulting length is then used unchecked when deriving session keys, copying attacker-controlled data past the end of a fixed-size stack buffer. An unauthenticated client exchanging EAP-SIM messages with a server that has the module enabled can trigger this to crash the RADIUS server process.
Other sources
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRADIUS servers with the EAP-SIM module enabled are exposed when they accept EAP-SIM authentication exchanges from clients.
Does exploitation require valid credentials or prior access?
No. An unauthenticated remote client can send specially crafted EAP-SIM messages; no privileges or user interaction are required.
What is the expected impact of a successful exploit?
The described impact is a crash of the RADIUS server process, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.