A flaw was found in freeradius's EAP-SIM module. The server copies the client-supplied EAP identity into an internal key-derivation structure without bounding its length against the destination field, and the resulting length is then used unchecked when deriving session keys, copying attacker-controlled data past the end of a fixed-size stack buffer. An unauthenticated client exchanging EAP-SIM messages with a server that has the module enabled can trigger this to crash the RADIUS server process.