CVE-2015-8764: Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.

Security readout for executives and security teams

This CVE describes a buffer overflow condition in FreeRADIUS 3.0 through 3.0.8 when the EAP-PWD module processes insufficiently validated EAP peer packets. For executives, the concern is authentication infrastructure stability and potential security impact, but the supplied sources do not provide CVSS, confirmed impact, patch details, or active exploitation evidence. Exposure is most likely where FreeRADIUS 3.0 through 3.0.8 is deployed and EAP-PWD is enabled or reachable by EAP peers. Organizations not using FreeRADIUS, not using EAP-PWD, or running outside the cited version range are less likely to be affected. Treat this as an authentication-infrastructure exposure review. Prioritize systems running the cited FreeRADIUS versions with EAP-PWD enabled, especially where RADIUS services are broadly reachable. Urgency is lower if EAP-PWD is not used, but evidence gaps mean vendor guidance should drive remediation decisions. Mitigation focus: Inventory FreeRADIUS deployments and identify versions 3.0 through 3.0.8.; Determine whether the EAP-PWD module is enabled or reachable.; Review the FreeRADIUS advisory for vendor-approved fixes or mitigations..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.