VulnerabilityAnalyzed

CVE-2026-58374

HIGH 7.1EPSS 0.29%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.

CVSS 3.1: 7.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-193
Affected: w1.fi/hostapd
Source: cve@mitre.org

References

https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187Patch
https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193Patch
https://w1.fi/security/2026-1/Issue Tracking
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txtMitigation, Third Party Advisory
https://www.openwall.com/lists/oss-security/2026/06/30/1Mailing List, Mitigation, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.