CVE Explorer
CVE-2026-58374
In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"hostapd","vendor":"w1.fi","versions":[{"lessThan":"2.12","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-193","description":"CWE-193 Off-by-one Error","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"Fix commit 46dd5a4 - missing link ID bounds check","tags":["patch"],"url":"https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/references/2
{"name":"Fix commit aa9d345 - BSS bounds check for link_id","tags":["patch"],"url":"https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/references/3
{"name":"hostap security advisory 2026-1 patch directory","tags":["vendor-advisory","patch"],"url":"https://w1.fi/security/2026-1/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/references/1
{"name":"hostap security advisory 2026-1: Missing multi-link parsing validation in wpa_supplicant and hostapd","tags":["vendor-advisory"],"url":"https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/references/0
{"url":"https://www.openwall.com/lists/oss-security/2026/06/30/1"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:91e663501b19ae5bdd7b32094f296afd84ad6ad4849aa2e72c9538b23e3ce2fa · sha256:b267bf00749a2126… · /containers/cna/references/4
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.