CVE-2026-127029
Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
CVE-2026-127029 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.60%EPSS, 49th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeradiusUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.1.12+dfsg-1.3ubuntu52.2.8+dfsg-0.12.2.8+dfsg-0.1build12.2.8+dfsg-0.1build22.2.8+dfsg-0.1ubuntu0.12.2.8+dfsg-0.1ubuntu0.1+esm1 | None known |
freeradiusUbuntu:18.04:LTS | All versions, plus listed versions 3.0.15+dfsg-1ubuntu23.0.16+dfsg-1ubuntu23.0.16+dfsg-1ubuntu33.0.16+dfsg-1ubuntu3.13.0.16+dfsg-1ubuntu3.2 | None known |
freeradiusUbuntu:20.04:LTS | All versions, plus listed versions 3.0.19+dfsg-33.0.19+dfsg-3build13.0.20+dfsg-13.0.20+dfsg-33.0.20+dfsg-3build1 Show 4 moreShow less3.0.20+dfsg-3ubuntu0.13.0.20+dfsg-3ubuntu0.23.0.20+dfsg-3ubuntu0.43.0.20+dfsg-3ubuntu0.5 | None known |
freeradiusUbuntu:22.04:LTS | All versions, plus listed versions 3.0.21+dfsg-2.23.0.21+dfsg-33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu23.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.13.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.23.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.4 | None known |
freeradiusUbuntu:24.04:LTS | All versions, plus listed versions 3.2.3+dfsg-23.2.3+dfsg-2build23.2.3+dfsg-2build63.2.3+dfsg-2build73.2.5+dfsg-3~ubuntu24.04.13.2.5+dfsg-3~ubuntu24.04.23.2.5+dfsg-3~ubuntu24.04.3 | None known |
freeradiusUbuntu:26.10 | All versions, plus listed versions 3.2.8+dfsg-1ubuntu23.2.8+dfsg-1ubuntu43.2.10+dfsg-1ubuntu1 | None known |
freeradiusUbuntu:26.04:LTS | All versions, plus listed versions 3.2.7+dfsg-1ubuntu23.2.8+dfsg-1ubuntu13.2.8+dfsg-1ubuntu2 | None known |
What each source reports
CVE List Score used
Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
CVE-2026-127029- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-12
EUVDEUVD-2026-124535
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
EUVD-2026-124535- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-gfm6-4qp3-m8ch
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber...
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
GHSA-gfm6-4qp3-m8ch- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-12
NVD
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
CVE-2026-127029- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-14
OSV
Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
CVE-2026-127029- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-14
OSVUBUNTU-CVE-2026-127029
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-127029- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/security/cve/CVE-2026-127029
bugzilla.redhat.com/show_bug.cgi?id=2572339
github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9
nvd.nist.gov/vuln/detail/CVE-2026-127029