FreeRADIUS CVE-2026-104201

Per the advisory title, the defect is in MS-MPPE key re-encryption, so exploitation requires the vulnerable component to process MS-MPPE key attributes - i.e., a RADIUS deployment that handles/forwards (re-encrypts) MS-MPPE-Send-Key/Recv-Key material, typically in a proxy/relay or MS-CHAP key-exchange flow. A limiting factor is that re-encryption uses the RADIUS shared secret, so the attacker likely needs a trust/peer relationship (knowledge of the shared secret or a position in the RADIUS path) to deliver the malformed attributes, meaning this is probably not anonymous internet-wide exploitation. NOTE: these conditions are inferred from the vulnerability description and general RADIUS/MS-MPPE behavior, not from an authoritative CVSS vector or vendor advisory in the input - the exact required configuration, versions, and whether a shared secret is needed must be confirmed from GHSA-wj29-mxmc-q98c.

Signal availability for this CVE is severely limited: no CVSS score or vector, no CWE, no EPSS probability, no CISA KEV listing, and no POC indicator are present in the input. The only hard facts are the advisory title (GHSA-wj29-mxmc-q98c, 'Heap OOB read/write in MS-MPPE key re-encryption') and that it was reported via vendor:ubuntu (Ubuntu Security tracker). A heap out-of-bounds READ AND WRITE is intrinsically serious - OOB write can enable memory corruption up to remote code execution, and the OOB read can leak sensitive key material, which is especially acute here because MS-MPPE attributes carry session encryption keys (RADIUS/MS-CHAP context). However, with no CVSS vector provided I CANNOT confirm the attack vector, complexity, or privilege requirement from the input. MS-MPPE key re-encryption is a RADIUS concept (strongly suggesting a RADIUS server implementation such as FreeRADIUS, though the exact product is NOT stated in the input and this is an inference). Exploitation status: no public exploit identified at time of analysis - neither KEV nor POC is indicated. Bottom line: the memory-safety nature (OOB read+write on key material) argues for prioritized patching, but the complete absence of CVSS/EPSS/KEV/POC signals means real-world exploitability and exploitation likelihood CANNOT be quantified from the data supplied and must be verified against the GHSA advisory and the vendor.

An attacker positioned as a RADIUS peer (e.g., a malicious or compromised home/proxy RADIUS server or client sharing the secret) sends a crafted packet containing MS-MPPE key attributes; when the receiving RADIUS server re-encrypts those keys, the malformed length/offset triggers a heap out-of-bounds read and write, potentially leaking adjacent key material or corrupting the heap to crash the service or achieve code execution. No public exploit code is identified in the provided data.