TI-2026-42005 Aliases CVE-2026-58374 GHSA-f38w-mwf7-vv8p

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be)…

LOW 31CWE-193Published 2026-06-30 · Updated 2026-06-30

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · High
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00294 22nd percentileScored 2026-11-07

Fix Partial hostapd (w1.fi): 2.12Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Wi-Fi Alliance	hostapd	before 2.12	2.12	Patch available	CNA

hostapd VendorWi-Fi Alliance Affected before 2.12 Fixed in 2.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:w1.fi:hostapd::::::::	up to 2.11	Vulnerable	Wi-Fi Alliance

cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:* Versions up to 2.11 Vulnerable ·Wi-Fi Alliance

Remediation

Fix · CNA hostapd (w1.fi) Fixed in 2.12

Red Hat 2 advisories

RHSA-2026:85277 Released 2026-10-19 · Red Hat rating Moderate
hostapd security update
- Red Hat Enterprise Linux AppStream (v. 9) hostapd-2.11-3.el9_8
RHSA-2026:85276 Released 2026-10-19 · Red Hat rating Moderate
hostapd security update
- Red Hat Enterprise Linux AppStream (v. 10) hostapd-2.11-3.el10_2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:85276
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:85277

Timeline

2026-10-02 Threatist record created from CVE-2026-58374
2026-10-03 Alias added: GHSA-f38w-mwf7-vv8p
2026-10-20 Fix available: RHSA-2026:85276 · Red Hat
2026-10-20 Fix available: RHSA-2026:85277 · Red Hat
2026-10-20 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat

References

Patch 4

Advisory 1

hostap security advisory 2026-1: Missing multi-link parsing validation in wpa_supplicant and hostapd

TI-2020-10094 The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the… CVSS 3.1HIGH 7.5
TI-2022-07426 The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are… CVSS 3.1CRITICAL 9.8
TI-2022-07427 The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are… CVSS 3.1CRITICAL 9.8
TI-2019-06933 Improper authentication in Wi-Fi Alliance hostapd with EAP-pwd support CVSS 3.0HIGH 8.1
TI-2017-09721 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of… CVSS 3.0HIGH 8.1
TI-2019-06935 Origin validation error in Wi-Fi Alliance hostapd with EAP-pwd support CVSS 3.1HIGH 8.1

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences