# CVE-2026-127029: FreeRADIUS stack buffer overflow in EAP-SIM module

Source: https://junglewise.ai/threats/cve-2026-127029-a-flaw-was-found-in-freeradius-s-extensible-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-127029 · Severity: high · CVSS 7.5 · Published 2026-11-12

FreeRADIUS is a RADIUS authentication server that handles network access control for organizations. An unauthenticated remote attacker can crash the RADIUS service by sending specially crafted messages to the EAP-SIM authentication module, causing a denial of service without requiring valid credentials.

Technologies: [Freeradius](https://junglewise.ai/threats/technologies/freeradius). Vendors: [Freeradius](https://junglewise.ai/threats/vendors/freeradius).

## Quick answers

**Is CVE-2026-127029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-127029 being exploited in the wild.

**How severe is CVE-2026-127029?** High severity, with a CVSS score of 7.5, published 12 November 2026.

**Which products and versions are affected?** FreeRADIUS FreeRADIUS.

**Is there a fix for CVE-2026-127029?** No fixed version is recorded yet. Disable the EAP-SIM submodule by commenting out or removing the sim configuration block in /etc/raddb/mods-available/eap (or /etc/raddb/mods-enabled/eap) if SIM-based authentication is not required, then restart the RADIUS service. Additionally, restrict RADIUS UDP traffic (ports 1812 and 1813) to trusted Network Access Server IP addresses using firewall rules.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-127029 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-127029?** Check whether you run Freeradius. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the EAP-SIM submodule by commenting out or removing the sim configuration block in /etc/raddb/mods-available/eap (or /etc/raddb/mods-enabled/eap) if SIM-based authentication is not required, then restart the RADIUS service. Additionally, restrict RADIUS UDP traffic (ports 1812 and 1813) to trusted Network Access Server IP addresses using firewall rules.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"}]

## Technical details

A stack buffer overflow exists in FreeRADIUS's EAP-SIM module due to unbounded copying of client-supplied identity data into a fixed-size buffer. An unauthenticated remote attacker can exploit this via crafted EAP-SIM authentication messages over the network, triggering a crash that denies service to legitimate users. The vulnerability is only present if the EAP-SIM submodule is explicitly enabled in the FreeRADIUS configuration.

## Affected products

- FreeRADIUS FreeRADIUS

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-127029](https://access.redhat.com/security/cve/CVE-2026-127029)

## Related threats

- [FreeRADIUS stack buffer overflow in EAP-FAST module](https://junglewise.ai/threats/cve-2026-127030-a-flaw-was-found-in-freeradius-an-improper-length-validation-in)
- [RADIUS Protocol MD5 collision forgery attack (Blast-RADIUS)](https://junglewise.ai/threats/cve-2024-3596-radius-protocol-md5-collision-forgery-attack-blast-radius)