CVE-2015-8763: The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a...

Security readout for executives and security teams

CVE-2015-8763 affects the EAP-PWD authentication module in FreeRADIUS 3.0 through 3.0.8. A remote EAP peer can send crafted commit or confirm messages that trigger an out-of-bounds read. The public record does not define business impact, CVSS severity, or active exploitation. Exposure is most likely where FreeRADIUS 3.0.0 through 3.0.8 is deployed and EAP-PWD is enabled for network authentication. Systems not using EAP-PWD are less likely to be affected, based on the CVE scope. Treat this as a targeted maintenance and exposure-reduction issue unless EAP-PWD is enabled on important authentication infrastructure. The impact is not fully described in public sources, so urgency depends on whether affected FreeRADIUS versions and EAP-PWD are present. Mitigation focus: Inventory FreeRADIUS deployments and identify versions 3.0.0 through 3.0.8.; Determine whether EAP-PWD is enabled in production authentication flows.; Check FreeRADIUS security guidance for the vendor-supported fixed version or configuration guidance..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.