The code in pppd that formats a response to a PEAP Request packet in peapresponse() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacketbuf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacketbuf array, most likely causing incorrect behavior or a crash.