Detections
Analytics
CVE-2026-127029
high
Description
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
References
https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572
https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124535