The code in pppd that formats a response to a PEAP Request packet in peap response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket buf array, most likely causing incorrect behavior or a crash.