Skip to main content

hostapd CVE-2026-58374

| EUVDEUVD-2026-40306 HIGH
Off-by-one Error (CWE-193)
2026-06-30 cve@mitre.org GHSA-f38w-mwf7-vv8p
Denial Of Service Buffer Overflow Hostapd Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
7.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vuln.today AI
7.1 HIGH

Adjacent wireless range (AV:A), no auth or interaction (PR:N/UI:N); confirmed impact is process crash (A:H) with only minor out-of-bounds write corruption (I:L) and no data disclosure (C:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 02, 2026 - 17:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 02, 2026 - 17:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 02, 2026 - 17:22 vuln.today
cvss_changed
Severity Changed
Jul 02, 2026 - 17:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 17:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)
Patch available
Jun 30, 2026 - 15:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:39 vuln.today

DescriptionNVD

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.

AnalysisAI

Denial of service in hostapd 2.11 through pre-2.12 development snapshots (built with CONFIG_IEEE80211BE) lets an unauthenticated attacker within wireless range crash the access-point daemon by sending a crafted Wi-Fi 7 (802.11be) Multi-Link association request. A malformed Multi-Link Element or Per-STA Profile subelement supplies a link_id of 15 that overruns the 15-entry (0-14) links[] array, causing an out-of-bounds write before the 4-way handshake. No public exploit identified at time of analysis; EPSS is low (0.29%, 20th percentile) and CISA SSVC rates exploitation as none.

Technical ContextAI

hostapd is the user-space daemon that implements IEEE 802.11 access-point management, authentication, and the WPA/RSN key handshakes on Linux and BSD systems (CPE cpe:2.3:a:w1.fi:hostapd). The flaw lives in the newer IEEE 802.11be (Wi-Fi 7) Multi-Link Operation code path, specifically hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, which parses Multi-Link Elements and Per-STA Profile subelements from association requests. The root cause is CWE-193 (off-by-one / boundary error): the parsed link_id can take the value 15, but the links[] storage array only has valid slots for link IDs 0 through 14, so index 15 writes just past the array bounds - a small heap/stack memory corruption during association processing.

RemediationAI

Vendor-released patch: hostapd 2.12, which includes the upstream 2026-1 fixes (commits 46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187 and aa9d345887389a251c63a3781d2ad2940d079193); upgrade all Wi-Fi 7 access points to 2.12 or later per https://w1.fi/security/2026-1/. Where immediate upgrade is not possible, the most direct compensating control is to rebuild/deploy hostapd without CONFIG_IEEE80211BE or disable 802.11be (Wi-Fi 7 / MLO) support in the AP configuration, which eliminates the vulnerable code path at the cost of losing Wi-Fi 7 multi-link functionality and forcing clients back to Wi-Fi 6/6E. Because the attack requires wireless-range proximity, restricting physical/RF access and reducing transmit power or coverage in exposed areas reduces (but does not remove) attacker reach as a stopgap. The oss-security disclosure is at https://www.openwall.com/lists/oss-security/2026/06/30/1.

More in Hostapd

View all
CVE-2017-13082 HIGH POC
8.1 Oct 17

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PT
CVE-2019-9499 HIGH
8.1 Apr 17

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validati
CVE-2019-9498 HIGH
8.1 Apr 17

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on
CVE-2019-9497 HIGH
8.1 Apr 17

The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element

CVE-2014-3686 MEDIUM
6.8 Oct 16

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli

CVE-2016-4476 HIGH
7.5 May 09

hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase paramete
CVE-2020-12695 HIGH
7.5 Jun 08

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription r
CVE-2019-9496 HIGH
7.5 Apr 17

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
CVE-2017-13084 MEDIUM
6.8 Oct 17

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) du
CVE-2017-13077 MEDIUM
6.8 Oct 17

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during
CVE-2017-13086 MEDIUM
6.8 Oct 17

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) duri
CVE-2022-37660 MEDIUM
6.5 Feb 11

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. Rated medium severit

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8
CVE-2021-23017 HIGH POC
7.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-58374 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy