CVE-2026-127029

freeradius: Stack-based buffer overflow via unbounded EAP-SIM identity length

freeradius

A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results…

12. Nov 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-127029
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2572339
• NVD
  CVE-2026-127029